CVE-2025-39720

ksmbd: fix refcount leak causing resource not released

At a glance

Severity: HIGH 7.5
EPSS: EPSS 0.29 % · percentile 21 (2026-10-28)
State: PUBLISHED
Published: 2025-09-05
Updated: 2026-08-05
Assigner: Linux
NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix refcount leak causing resource not released When ksmbd_conn_releasing(opinfo->conn) returns true,the refcount was not decremented properly, causing a refcount leak that prevents the count from reaching zero and the memory from being released.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2025-31507
GCVE · GCVE-0-2025-39720

CERT-FR advisories

CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0246 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
CERTFR-2026-AVI-0227 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
CERTFR-2026-AVI-0218 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0194 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
CERTFR-2026-AVI-0169 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
CERTFR-2025-AVI-0825 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.15 < 6.6.103
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.7 < 6.12.44
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.13 < 6.16.4
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*

Affected products

Product	Versions
Linux · Linux	affected 0626e6641f6b467447c81dd7678a69c66f7746cf < a1d2bab4d53368a526c97aba92671dd71814f95a ; affected 0626e6641f6b467447c81dd7678a69c66f7746cf < 36e010bb865fbaa1202fe9bcce3fd486d6db7606 ; affected 0626e6641f6b467447c81dd7678a69c66f7746cf < 9a7abce6e8c0e2145b346a6d4abf0d9655e9b0e8 ; affected 0626e6641f6b467447c81dd7678a69c66f7746cf < 89bb430f621124af39bb31763c4a8b504c9651e2
Linux · Linux	affected 5.15 ; unaffected 0 < 5.15 ; unaffected 6.6.103 ≤ 6.6.* ; unaffected 6.12.44 ≤ 6.12.* ; unaffected 6.16.4 ≤ 6.16.* ; unaffected 6.17 ≤ *

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD