CVE-2025-71151
cifs: Fix memory and information leak in smb3_reconfigure()
Reported by linux · Published January 23, 2026
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory and information leak in smb3_reconfigure() In smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the function returns immediately without freeing and erasing the newly allocated new_password and new_password2. This causes both a memory leak and a potential information leak. Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.
EPSS 0.14% · 3.1th percentile
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 880a661e67648a3ffe85405e8de5f50650a3c0b2, 0e4145774c016530bf99afb3675a1a0593c35642, 0f0e357902957fba28ed31bde0d6921c6bd1485d |
| Linux | Linux | 6.13, 0, 6.6.120 |
| linux | linux_kernel | 6.6.64, 6.11.11, 6.13 |
| amazon:2023 | perf6.12 | 0 |
| amazon:2023 | kernel6.12-libbpf | 0 |
| amazon:2023 | kernel6.12-modules-extra-common | 0 |
| amazon:2023 | python3-perf6.12 | 0 |
| amazon:2023 | kernel6.12-libbpf-devel | 0 |
| amazon:2023 | kernel6.12-tools | 0 |
| amazon:2023 | kernel6.12-headers | 0 |
| amazon:2023 | bpftool6.12 | 0 |
| amazon:2023 | kernel6.12-tools-devel | 0 |
| amazon:2023 | kernel6.12-devel | 0 |
| amazon:2023 | kernel6.12-modules-extra | 0 |
| Linux | Linux | 6.11.11, 6.13, 6.6.64 |
| amazon:2023 | kernel6.12 | 0 |
| amazon:2023 | kernel-livepatch-6.12.64-87.122 | 0 |
| amazon:2023 | kernel6.12-libbpf-static | 0 |
Timeline
- Jan 23, 2026 CVE Published
- Jan 24, 2026 EPSS Score (30 in total, the first dated here)
- Feb 2, 2026 Security Advisory (128 in total, the first dated here)
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
- Apr 29, 2026 Distribution Patch (125 in total, the first dated here)
- Sep 27, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-71151
vulnetix vdb fixes CVE-2025-71151Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-71151/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart