In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
The kernel ASN.1 BER decoder calls action callbacks incrementally as it
walks the input. When ksmbd_decode_negTokenInit() reaches the mechToken
[2] OCTET STRING element, ksmbd_neg_token_alloc() allocates
conn->mechToken immediately via kmemdup_nul(). If a later element in
the same blob is malformed, then the decoder will return nonzero after
the allocation is already live. This could happen if mechListMIC [3]
overrunse the enclosing SEQUENCE.
decode_negotiation_token() then sets conn->use_spnego = false because
both the negTokenInit and negTokenTarg grammars failed. The cleanup at
the bottom of smb2_sess_setup() is gated on use_spnego:
if (conn->use_spnego && conn->mechToken) {
kfree(conn->mechToken);
conn->mechToken = NULL;
}
so the kfree is skipped, causing the mechToken to never be freed.
This codepath is reachable pre-authentication, so untrusted clients can
cause slow memory leaks on a server without even being properly
authenticated.
Fix this up by not checking check for use_spnego, as it's not required,
so the memory will always be properly freed. At the same time, always
free the memory in ksmbd_conn_free() incase some other failure path
forgot to free it.
References
Configurations
Configuration 1 (hide)
|
History
24 Jul 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Apr 2026, 16:51
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-401 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| First Time |
Linux
Linux linux Kernel |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/269c800a7a7e363459291885b35f7bc72e231ed6 - Patch | |
| References | () https://git.kernel.org/stable/c/6c8c44e6553b9f072f62d9875e567766eb293162 - Patch | |
| References | () https://git.kernel.org/stable/c/745a535461bbb90a56d9357573c9f97a5c12abe1 - Patch | |
| References | () https://git.kernel.org/stable/c/ad0057fb91218914d6c98268718ceb9d59b388e1 - Patch | |
| References | () https://git.kernel.org/stable/c/dd53414e301beb915fe672dc4c4a51bafb917604 - Patch | |
| References | () https://git.kernel.org/stable/c/dd577cb55588ec3fbc66af3621280306601c4192 - Patch |
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Apr 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-24 15:16
Updated : 2026-07-24 15:17
NVD link : CVE-2026-31610
Mitre link : CVE-2026-31610
CVE.ORG link : CVE-2026-31610
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-401
Missing Release of Memory after Effective Lifetime