CVE-2025-40268 in Linux
Summary
by MITRE • 12/07/2025
In the Linux kernel, the following vulnerability has been resolved:
cifs: client: fix memory leak in smb3_fs_context_parse_param
The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. Regarding fc->source, there is no code in the fs context related to its memory reclamation.
To fix this memory leak, release the source memory corresponding to ctx or fc before each parsing.
syzbot reported: BUG: memory leak unreferenced object 0xffff888128afa360 (size 96): backtrace (crc 79c9c7ba): kstrdup+0x3c/0x80 mm/util.c:84 smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444
BUG: memory leak unreferenced object 0xffff888112c7d900 (size 96): backtrace (crc 79c9c7ba): smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629 smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/23/2026
The vulnerability CVE-2025-40268 represents a memory leak in the Linux kernel's CIFS (Common Internet File System) client implementation, specifically within the smb3_fs_context_parse_param function. This issue occurs when a user application invokes the fsconfig system call multiple times to configure a CIFS filesystem context, creating a scenario where memory allocated during the first fsconfig call is not properly released before the second call. The root cause stems from inadequate memory management in the filesystem context parsing code where the ctx->source pointer is freed only during the second fsconfig operation, leaving the first allocation unreferenced and thus leaked. The vulnerability manifests through the kernel's memory management subsystem where kstrdup allocates memory for string operations but fails to properly reclaim it, creating unreferenced objects that persist in memory until the system reboots.
The technical flaw exists in the fs/smb/client/fs_context.c file where the smb3_fs_context_parse_param function handles parameter parsing for SMB3 filesystem contexts. When fsconfig is called twice, the function allocates memory for source parameters but does not implement proper cleanup mechanisms between calls. The memory leak occurs because the fc->source field, which contains the filesystem source information, lacks explicit memory reclamation code in the context parsing logic. This creates a classic memory management issue where allocated kernel memory remains unreferenced and unavailable for reuse. The syzbot automated testing system identified this vulnerability through memory leak detection, showing two separate unreferenced objects of 96 bytes each, both pointing to the same smb3_fs_context_parse_param function where kstrdup was called. This pattern indicates that the kernel's filesystem context management does not properly handle the lifecycle of source parameter allocations during multiple configuration calls.
The operational impact of this memory leak is significant for systems running Linux kernels with CIFS client functionality, particularly those that frequently configure or reconfigure SMB filesystem mounts. While individual memory leaks may appear minor, repeated usage of fsconfig with CIFS filesystems can lead to progressive memory consumption that degrades system performance over time. The vulnerability affects kernel memory management and could potentially contribute to system instability if memory exhaustion occurs, especially on systems with limited memory resources or high-frequency filesystem configuration operations. This type of memory leak aligns with CWE-401: Improper Release of Memory and represents a failure in the kernel's resource management protocols. The leak is particularly concerning in server environments where CIFS mounts are frequently established and torn down, as it could lead to gradual memory fragmentation and reduced system responsiveness.
Mitigation strategies for this vulnerability require immediate kernel updates to the patched version containing the fix for the smb3_fs_context_parse_param function. The fix involves implementing proper memory cleanup before each parsing operation by releasing the source memory corresponding to either ctx or fc before subsequent parsing calls. System administrators should monitor affected systems for memory usage patterns and consider implementing memory monitoring alerts to detect potential memory exhaustion. The fix aligns with ATT&CK technique T1484.001: Privilege Escalation through Kernel Exploitation, as memory leaks can be leveraged by malicious actors to exhaust system resources or potentially create conditions for more serious exploits. Organizations should prioritize patching this vulnerability as part of their regular security maintenance procedures, particularly those operating CIFS servers or clients that frequently reconfigure filesystem mounts. Additionally, kernel developers should implement more robust memory management patterns for filesystem context handling to prevent similar issues in other filesystem implementations.