CVE-2026-31711

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: server: fix active_num_conn leak on transport allocation failure

Commit 77ffbcac4e56 ("smb: server: fix leak of active_num_conn in

ksmbd_tcp_new_connection()") addressed the kthread_run() failure

path. The earlier alloc_transport() == NULL path in the same

function has the same leak, is reachable pre-authentication via any

TCP connect to port 445, and was empirically reproduced on UML

(ARCH=um, v7.0-rc7): a small number of forced allocation failures

were sufficient to put ksmbd into a state where every subsequent

connection attempt was rejected for the remainder of the boot.

ksmbd_kthread_fn() increments active_num_conn before calling

ksmbd_tcp_new_connection() and discards the return value, so when

alloc_transport() returns NULL the socket is released and -ENOMEM

returned without decrementing the counter. Each such failure

permanently consumes one slot from the max_connections pool; once

cumulative failures

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References