Listen to this Post
The vulnerability is a memory leak within the `parse_lease_state()` function of the ksmbd (kernel SMB daemon) module in the Linux kernel. The flaw was introduced when a previous security patch added bounds checks for the create lease context but created an unintended side effect. When the kernel processes a malformed SMB request, this function allocates a `lease_ctx_info` structure (pointed to by lreq). If the newly added boundary validation on the incoming request data fails, the function incorrectly returns a NULL pointer without first releasing the memory allocated for lreq. Each time a malicious or malformed request triggers this error path, a fragment of kernel memory is permanently leaked. Over time, repeated exploitation can exhaust available kernel memory, leading to system instability or a denial-of-service condition.
dailycve form:
Platform: Linux Kernel
Version: ksmbd enabled
Vulnerability: Memory Leak
Severity: Medium
date: 2025-05-20
Prediction: 2025-05-27
What Undercode Say:
Check if the ksmbd module is loaded:
`lsmod | grep ksmbd`
To unload the ksmbd module immediately:
`sudo modprobe -r ksmbd`
To prevent the ksmbd module from loading at boot, add it to the deny list:
`echo “blacklist ksmbd” | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf`
Kernel boot parameter to disable loading (if built-in):
`ksmbd.disable=1`
How Exploit:
An attacker sends specially crafted SMB2 packets that fail the bounds check in parse_lease_state().
Each request causes the kernel to leak the allocated `lease_ctx_info` structure.
Repeated attacks deplete kernel memory (slab).
Protection from this CVE
Apply the official kernel patch from the Linux kernel git repository.
Disable the ksmbd module if not required.
Restrict network access to SMB ports (445/tcp).
Impact:
Gradual exhaustion of kernel memory.
System instability and denial-of-service.
No direct impact on confidentiality or integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
