CVE-2026-31711

취약점 유형

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix active_num_conn leak on transport allocation failure Commit 77ffbcac4e56 ("smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()") addressed the kthread_run() failure path. The earlier alloc_transport() == NULL path in the same function has the same leak, is reachable pre-authentication via any TCP connect to port 445, and was empirically reproduced on UML (ARCH=um, v7.0-rc7): a small number of forced allocation failures were sufficient to put ksmbd into a state where every subsequent connection attempt was rejected for the remainder of the boot. ksmbd_kthread_fn() increments active_num_conn before calling ksmbd_tcp_new_connection() and discards the return value, so when alloc_transport() returns NULL the socket is released and -ENOMEM returned without decrementing the counter. Each such failure permanently consumes one slot from the max_connections pool; once cumulative failures reach the cap, atomic_inc_return() hits the threshold on every subsequent accept and every new connection is rejected. The counter is only reset by module reload. An unauthenticated remote attacker can dri

영향받는 제품

• linux linux_kernel

참고 자료

• https://git.kernel.org/stable/c/283027aa93380380a0994f35dde3ec95318f2654
• https://git.kernel.org/stable/c/295a9fc6789d1011c36ded9f0f2907bb34fa0de4
• https://git.kernel.org/stable/c/60734c8bc3b4aa0672e251f08dda81977e4b5387
• https://git.kernel.org/stable/c/6551300dc452ac16a855a83dbd1e74899542d3b3
• https://git.kernel.org/stable/c/97f8d2648ef4871e4cd335e2d769cb40054a6772
• https://git.kernel.org/stable/c/dc2e7d595d68cf1be1ba64e3d30ebf3266bf7242