CVE-2025-68295 — Missing Release of Resource after Effective Lifetime in Linux
Severity
7.8HIGHOSV
OSV7.2OSV3.2
No vectorEPSS
0.1%
top 79.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 16
Latest updateApr 13
Description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix memory leak in cifs_construct_tcon()
When having a multiuser mount with domain= specified and using
cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname,
so it needs to be freed before leaving cifs_construct_tcon().
This fixes the following memory leak reported by kmemleak:
mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,...
su - testuser
cifscreds add -d ZELDA -u testuser
...
ls /mnt/1…
Affected Packages7 packages
▶CVEListV5linux/linuxf2aee329a68f5a907bcff11a109dfe17c0b41aeb — ff8f9bd1c46ee02d5558293915d42e82646d5ee9+12