CVE-2026-23205

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb/client: fix memory leak in smb2_open_file()<br /> <br /> Reproducer:<br /> <br /> 1. server: directories are exported read-only<br /> 2. client: mount -t cifs //${server_ip}/export /mnt<br /> 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct<br /> 4. client: umount /mnt<br /> 5. client: sleep 1<br /> 6. client: modprobe -r cifs<br /> <br /> The error message is as follows:<br /> <br /> =============================================================================<br /> BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()<br /> -----------------------------------------------------------------------------<br /> <br /> Object 0x00000000d47521be @offset=14336<br /> ...<br /> WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577<br /> ...<br /> Call Trace:<br /> <br /> kmem_cache_destroy+0x94/0x190<br /> cifs_destroy_request_bufs+0x3e/0x50 [cifs]<br /> cleanup_module+0x4e/0x540 [cifs]<br /> __se_sys_delete_module+0x278/0x400<br /> __x64_sys_delete_module+0x5f/0x70<br /> x64_sys_call+0x2299/0x2ff0<br /> do_syscall_64+0x89/0x350<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> ...<br /> kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs]<br /> WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577