CVE-2025-71151: Linux Kernel CIFS Information Disclosure

CVE-2025-71151 Overview

A memory and information leak vulnerability has been identified in the Linux kernel's CIFS (Common Internet File System) subsystem. The issue exists within the smb3_reconfigure() function, where improper error handling leads to both memory leakage and potential exposure of sensitive credential information.

When smb3_sync_session_ctx_passwords() fails during SMB3 session reconfiguration, the function returns immediately without properly freeing or securely erasing the newly allocated new_password and new_password2 buffers. This dual-impact vulnerability can lead to memory exhaustion over time and may leave sensitive authentication credentials exposed in kernel memory.

Critical Impact

Memory leak combined with potential exposure of SMB3 authentication credentials in kernel memory, which could be leveraged by local attackers for credential theft or denial of service through memory exhaustion.

Affected Products

• Linux Kernel (CIFS/SMB3 subsystem)
• Systems utilizing SMB3 mount reconfiguration functionality
• Enterprise file servers and NAS systems running affected kernel versions

Discovery Timeline

• 2026-01-23 - CVE CVE-2025-71151 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-71151

Vulnerability Analysis

This vulnerability is classified as a Memory Leak with an accompanying Information Disclosure component. The root cause lies in the error handling path of the smb3_reconfigure() function within the Linux kernel's CIFS filesystem implementation.

During SMB3 mount reconfiguration operations, the kernel allocates memory for new password buffers (new_password and new_password2) to handle credential updates. When the subsequent call to smb3_sync_session_ctx_passwords() fails, the error path immediately returns without deallocating these buffers or securely wiping their contents.

The failure to call kfree_sensitive() on the password buffers creates two distinct security concerns: first, kernel memory is leaked with each failed reconfiguration attempt, potentially leading to resource exhaustion; second, sensitive authentication credentials remain in memory longer than necessary, increasing the window for potential extraction by other processes or through memory disclosure vulnerabilities.

Root Cause

The vulnerability stems from missing cleanup code in the error handling path of smb3_reconfigure(). When smb3_sync_session_ctx_passwords() returns an error, the function exits without executing the necessary deallocation routines for the new_password and new_password2 buffers. The fix involves adding kfree_sensitive() calls for both password buffers before returning in the error case, ensuring both proper memory deallocation and secure erasure of sensitive credential data.

Attack Vector

The attack vector for this vulnerability is local. An attacker with the ability to trigger SMB3 mount reconfigurations could potentially:

1. Memory Exhaustion: Repeatedly trigger failed reconfiguration attempts to exhaust kernel memory, leading to denial of service
2. Credential Exposure: Exploit the lingering credentials in kernel memory through additional vulnerabilities or debugging interfaces to extract SMB3 authentication passwords

The exploitation requires local access to the system and the ability to perform SMB3 filesystem operations or trigger reconfiguration events through mount operations.

Detection Methods for CVE-2025-71151

Indicators of Compromise

• Abnormal kernel memory growth over time, particularly in systems with frequent SMB3 mount operations
• Failed SMB3 reconfiguration events in system logs (dmesg or /var/log/kern.log)
• Memory allocation warnings or out-of-memory conditions in CIFS-related kernel subsystems
• Unusual patterns of mount/remount operations on CIFS/SMB3 filesystems

Detection Strategies

• Monitor kernel memory usage patterns, specifically tracking allocations in the CIFS subsystem using tools like /proc/meminfo and slabtop
• Implement audit rules to log SMB3 mount reconfiguration attempts and failures
• Deploy memory leak detection tools such as kmemleak to identify unreleased password buffers
• Review system logs for repeated CIFS reconfiguration failures that could indicate exploitation attempts

Monitoring Recommendations

• Configure SentinelOne Singularity platform to monitor for abnormal kernel memory consumption patterns
• Enable kernel debugging features in development environments to track memory allocation and deallocation in CIFS code paths
• Set up alerting for CIFS-related error messages indicating password synchronization failures
• Implement regular memory auditing on systems with heavy SMB3/CIFS usage

How to Mitigate CVE-2025-71151

Immediate Actions Required

• Update to a patched Linux kernel version that includes the fix for this vulnerability
• Review system logs for evidence of failed SMB3 reconfiguration attempts
• Consider temporarily restricting SMB3 mount reconfiguration capabilities in high-security environments
• Monitor affected systems for memory exhaustion symptoms until patches can be applied

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds proper cleanup by calling kfree_sensitive() on both new_password and new_password2 buffers before returning in the error case of smb3_reconfigure().

Patches are available through the following kernel git commits:

• Kernel Git Commit 5679cc90
• Kernel Git Commit bb82aaee
• Kernel Git Commit bc390b27
• Kernel Git Commit cb6d5aa9

Apply the appropriate patch for your kernel version or update to a stable kernel release that includes this fix.

Workarounds

• Limit SMB3 mount reconfiguration operations to essential administrative tasks only
• Implement access controls to restrict which users can perform CIFS/SMB3 mount operations
• Consider using static mount configurations where possible to avoid reconfiguration scenarios
• Enable memory monitoring and alerting to detect potential exploitation attempts before service degradation occurs