linux-cve-announce - CVE-2025-71151: cifs: Fix memory and information leak in smb3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026012328-CVE-2025-71151-1a45@gregkh>
Date: Fri, 23 Jan 2026 15:15:31 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-71151: cifs: Fix memory and information leak in smb3_reconfigure()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix memory and information leak in smb3_reconfigure()

In smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the
function returns immediately without freeing and erasing the newly
allocated new_password and new_password2. This causes both a memory leak
and a potential information leak.

Fix this by calling kfree_sensitive() on both password buffers before
returning in this error case.

The Linux kernel CVE team has assigned CVE-2025-71151 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.64 with commit 880a661e67648a3ffe85405e8de5f50650a3c0b2 and fixed in 6.6.120 with commit bc390b2737205163e48cc1655f6a0c8cd55b02fc
	Issue introduced in 6.12.2 with commit 0e4145774c016530bf99afb3675a1a0593c35642 and fixed in 6.12.64 with commit 5679cc90bb5415801fa29041da0319d9e15d295d
	Issue introduced in 6.13 with commit 0f0e357902957fba28ed31bde0d6921c6bd1485d and fixed in 6.18.3 with commit bb82aaee16907dc4d0b9b0ca7953ceb3edc328c6
	Issue introduced in 6.13 with commit 0f0e357902957fba28ed31bde0d6921c6bd1485d and fixed in 6.19-rc3 with commit cb6d5aa9c0f10074f1ad056c3e2278ad2cc7ec8d
	Issue introduced in 6.11.11 with commit 674ba43944dab8e8f87434e25d9d10c5152584bc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-71151
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/client/fs_context.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bc390b2737205163e48cc1655f6a0c8cd55b02fc
	https://git.kernel.org/stable/c/5679cc90bb5415801fa29041da0319d9e15d295d
	https://git.kernel.org/stable/c/bb82aaee16907dc4d0b9b0ca7953ceb3edc328c6
	https://git.kernel.org/stable/c/cb6d5aa9c0f10074f1ad056c3e2278ad2cc7ec8d