CVE-2025-71151

cifs: Fix memory and information leak in smb3_reconfigure()

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix memory and information leak in smb3_reconfigure()

In smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the function returns immediately without freeing and erasing the newly allocated new_password and new_password2. This causes both a memory leak and a potential information leak.

Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.14%Up 0.1 points since Jan 24, 2026

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix memory and information leak in smb3_reconfigure()

Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.

Record: CVE-2025-71151
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-401
Updated: 2026-11-02

CVE List No score

cifs: Fix memory and information leak in smb3_reconfigure()

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix memory and information leak in smb3_reconfigure()

Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.

Record: CVE-2025-71151
Updated: 2026-11-02

EUVDEUVD-2026-4391 No score

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix memory and information leak in smb3_reconfigure()

Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.

Record: EUVD-2026-4391
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mp8m-m46q-cqx4 5.5

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory and...

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix memory and information leak in smb3_reconfigure()

Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.

Record: GHSA-mp8m-m46q-cqx4
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-401
Updated: 2026-11-02

OSVBELL-CVE-2025-71151 5.5

Record: BELL-CVE-2025-71151
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-71151 5.5

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory and information leak in smb3_reconfigure() In smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the function returns immediately without freeing and erasing the newly allocated new_password and new_password2. This causes both a memory leak and a potential information leak. Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.

Record: DEBIAN-CVE-2025-71151
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 27 moreShow less

OSVOESA-2026-1303 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()

Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage.

syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1]

As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH.

Rename helpers to better reflect they are safe against BH only.

ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()
skb_array_resize_multiple() to skb_array_resize_multiple_bh()

[1]

WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Modules linked in: CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d R10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550(CVE-2024-57994)

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params

Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI is valid to prevent NULL pointer deference due to missing DAI widgets in topologies with aggregated amps.(CVE-2024-58012)

In the Linux kernel, the following vulnerability has been resolved:

driver core: fix potential NULL pointer dereference in dev_uevent()

If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it.

Use WRITE_ONCE() when setting the…

Record: OESA-2026-1303
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-1304 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()

Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage.

syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1]

As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH.

Rename helpers to better reflect they are safe against BH only.

ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()
skb_array_resize_multiple() to skb_array_resize_multiple_bh()

[1]

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params

In the Linux kernel, the following vulnerability has been resolved:

driver core: fix potential NULL pointer dereference in dev_uevent()

Use WRITE_ONCE() when setting the…

Record: OESA-2026-1304
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-1305 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()

Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage.

syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1]

As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH.

Rename helpers to better reflect they are safe against BH only.

ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()
skb_array_resize_multiple() to skb_array_resize_multiple_bh()

[1]

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params

In the Linux kernel, the following vulnerability has been resolved:

driver core: fix potential NULL pointer dereference in dev_uevent()

Use WRITE_ONCE() when setting the…

Record: OESA-2026-1305
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHBA-2025:6279 5.5

Red Hat Bug Fix Advisory: kernel bug fix and enhancement update

Record: RHBA-2025:6279
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:6966 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2025:6966
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2025-71151 5.5

CVE-2025-71151 in linux - Patched by Root

Root has patched CVE-2025-71151 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-71151
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-71151 5.5

Record: UBUNTU-CVE-2025-71151
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-11

OSVCLSA-2026-1780052998 No score

kernel: Fix of 102 CVEs

smb: client: reject userspace cifs.spnego descriptions
usb: ulpi: fix memory leak on ulpi_register() error paths
usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
mptcp: consolidate suboption status {CVE-2025-21707}
blktrace: fix __this_cpu_read/write in preemptible context {CVE-2026-23374}
espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097}
net: usb: asix: validate PHY address before use {CVE-2025-71094}
driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997}
crypto: af_alg - Set merge to zero early in af_alg_sendmsg {CVE-2025-39931}
bonding: fix use-after-free due to enslave fail after slave array update {CVE-2026-23171}
Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT {CVE-2025-38335}
spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
mm/smaps: fix race between smaps_hugetlb_range and migration {CVE-2025-39754}
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
mm/userfaultfd: fix hugetlb fault mutex hash calculation {CVE-2026-31575}
RDMA/irdma: Initialize free_qp completion before using it {CVE-2026-31492}
calipso: Don't call calipso functions for AF_INET sk. {CVE-2025-38147}
mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040}
espintcp: fix skb leaks {CVE-2025-38057}
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize {CVE-2023-53667}
memcg: fix soft lockup in the OOM process {CVE-2024-57977}
futex: Clear stale exiting pointer in futex_lock_pi() retry path {CVE-2026-31555}
trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
dm-verity: disable recursive forward error correction {CVE-2025-71161}
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}
vfs: Don't evict inode under the inode lru traversing context {CVE-2024-45003}
ipvs: fix uninit-value for saddr in do_output_route4 {CVE-2025-37961}
sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
net: phy: leds: fix memory leak {CVE-2025-37989}
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper {CVE-2025-39681}
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764}
sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
kobject: Add sanity check for kset->kobj.ktype in kset_register() {CVE-2023-53480}
io_uring: check if iowq is killed before queuing {CVE-2024-56709}
netfilter: x_tables: fix percpu counter block leak on error path when creating new netns {CVE-2023-53200}
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed {CVE-2023-53481}
udf: Do not update file length for failed writes to inline files {CVE-2023-53295}
bpf: Forget ranges when refining tnum after JSET {CVE-2025-39748}
perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
misc: vmw_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-53279}
can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write {CVE-2023-53344}
tracing: Fix race issue between cpu buffer write and swap {CVE-2023-53368}
KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141}
io_uring/tctx: work around xa_store() allocation error issue {CVE-2024-56584}
objtool: Fix memory leak in create_static_call_sections() {CVE-2023-53423}
net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
PM: EM: fix memory leak with using debugfs_lookup() {CVE-2023-53411}
ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
watchdog: Fix kmemleak in watchdog_cdev_register {CVE-2023-53234} -…

Record: CLSA-2026-1780052998
Updated: 2026-11-02

OSV No score

cifs: Fix memory and information leak in smb3_reconfigure()

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix memory and information leak in smb3_reconfigure()

Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.

Record: CVE-2025-71151
Updated: 2026-11-02

OSVUSN-8177-1 No score

linux, linux-realtime vulnerabilities

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)