CVE-2026-90125

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix request buffer leak in smb2_new_read_req()

smb2_new_read_req() allocates the request buffer with

smb2_plain_req_init() but only publishes it to the caller with

*buf = req at the very end of the function. Two error returns sit in

between:

rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server,

(void **) &req, total_len);

if (rc)

return rc;

if (server == NULL)

return -ECONNABORTED;

[...]

rdata->mr = smbd_register_mr(server->smbd_conn,

&rdata->subreq.io_iter,

true, need_invalidate);

if (!rdata->mr)

return -EAGAIN;

On either of them the buffer is neither released nor handed back, so

it is leaked. The caller cannot clean up after it: smb2_async_readv()

does 'goto out' on a non-zero return, which skips the

cifs_small_buf_release(buf) at async_readv_out, and buf has not been

assigned at that point in any case.

The write path has never had this problem. smb2_as

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References