CVE-2026-90125 — smb: client: fix request buffer leak in smb2_new_read_req()

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix request buffer leak in smb2_new_read_req()

smb2_new_read_req() allocates the request buffer with smb2_plain_req_init() but only publishes it to the caller with *buf = req at the very end of the function. Two error returns sit in between:

rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, (void **) &req, total_len); if (rc) return rc;

if (server == NULL) return -ECONNABORTED; [...] rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->subreq.io_iter, true, need_invalidate); if (!rdata->mr) return -EAGAIN;

On either of them the buffer is neither released nor handed back, so it is leaked. The caller cannot clean up after it: smb2_async_readv() does 'goto out' on a non-zero return, which skips the cifs_small_buf_release(buf) at async_readv_out, and buf has not been assigned at that point in any case.

The write path has never had this problem. smb2_async_writev() registers the memory region inline and jumps to its release label instead of returning:

wdata->mr = smbd_register_mr(...); if (!wdata->mr) { rc = -EAGAIN; goto async_writev_out; }

Commit b7972092199f ("cifs: smbd: Retry on memory registration failure") changed both sides from -ENOBUFS to -EAGAIN in a single patch, which puts the two shapes next to each other.

Only the -EAGAIN return is reachable in practice, because smb2_plain_req_init() calls smb2_reconnect() first and t…

Most recent entries from all

CVE-2026-90125 — smb: client: fix request buffer leak in smb2_new_read_req()