CVE-2026-31610
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, a vulnerability was found in ksmbd (kernel SMB server implementation) involving a mechToken memory leak when SPNEGO decode fails after token allocation. The ASN.1 BER decoder calls action callbacks as it processes data. When ksmbd_decode_negTokenInit() reaches the mechToken element, it allocates memory for conn->mechToken. If a later element in the blob is malformed, the decoder returns an error but the memory remains allocated. The decode_negotiation_token() function sets conn->use_spnego = false, and cleanup in smb2_sess_setup() is gated on use_spnego, so the memory is not freed. Untrusted clients can cause slow memory leaks on the server.
Risk Assessment
The risk is the possibility of exhausting server memory by unauthenticated clients, which can lead to Denial of Service (DoS) through resource exhaustion.
Recommendation
It is recommended to apply the Linux kernel patch that removes the use_spnego condition in memory cleanup and always frees the memory in ksmbd_conn_free().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input. When ksmbd_decode_negTokenInit() reaches the mechToken [2] OCTET STRING element, ksmbd_neg_token_alloc() allocates conn->mechToken immediately via kmemdup_nul(). If a later element in the same blob is malformed, then the decoder will return nonzero after the allocation is already live. This could happen if mechListMIC [3] overrunse the enclosing SEQUENCE. decode_negotiation_token() then sets conn->use_spnego = false because both the negTokenInit and negTokenTarg grammars failed. The cleanup at the bottom of smb2_sess_setup() is gated on use_spnego: if (conn->use_spnego && conn->mechToken) { kfree(conn->mechToken); conn->mechToken = NULL; } so the kfree is skipped, causing the mechToken to never be freed. This codepath is reachable pre-authentication, so untrusted clients can cause slow memory leaks on a server without even being properly authenticated. Fix this up by not checking check for use_spnego, as it's not required, so the memory will always be properly freed. At the same time, always free the memory in ksmbd_conn_free() incase some other failure path forgot to free it.