Memory leak in Linux kernel - CVE-2026-90125
Published: September 19, 2026
Vulnerability identifier: #VU151364
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90125
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource release in smb2_new_read_req() in the SMB client when handling asynchronous SMB2 read requests after memory registration fails. A local user can issue asynchronous SMB2 read requests during a memory registration failure to cause a denial of service.
Only asynchronous SMB read operations are affected. On hard mounts, replayable failures can repeat the operation without a retransmission-count bound.
Affected software
Linux kernel
How to mitigate CVE-2026-90125
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/12092ed28434bf41e08d41e3c5269eb6b337fc02
- https://git.kernel.org/stable/c/442c5f1358ced0d4e716778ac06f1e323a7e4f21
- https://git.kernel.org/stable/c/58066940076b90c16e821fd6f9767cd979cbdb5e
- https://git.kernel.org/stable/c/73f6bdb0380486ab37fe12cd74de20abfaf5d3ae
- https://git.kernel.org/stable/c/deb6468f4164640e4dc875f008aa449cf55987a5