Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s in-kernel SMB server, ksmbd, can leak session references when handling an invalid session. Repeated triggering could consume kernel resources and disrupt file-sharing availability. The supplied CVSS score is 7.5, reflecting remotely reachable denial-of-service risk without authentication or user interaction.
Executive priority
Prioritize internet-facing or broadly reachable ksmbd servers for prompt assessment and patching. Systems without ksmbd enabled are unlikely to be exposed. Treat this primarily as a service-availability risk, and require owners to confirm distribution-specific fixes because kernel backports can make version-only conclusions unreliable.
Technical view
During session lookup, ksmbd acquires a reference even when the located session is not SMB2_SESSION_VALID. The affected path fails to call ksmbd_user_session_put, leaking that reference. The published correction releases it explicitly. The documented impact is availability loss; the sources do not claim confidentiality or integrity compromise.
Likely exposure
Exposure is limited to Linux systems using ksmbd, particularly where SMB is reachable from untrusted networks. A Linux host is not exposed merely because it runs Linux. The bundle lists affected releases and commit identifiers, but administrators should confirm applicability through their distribution’s kernel advisory and backport status.
Exploitation context
The supplied record is not in CISA KEV, and the source bundle provides no evidence of active exploitation or a public exploit. Network reachability, low complexity, and no required privileges increase theoretical abuse potential, but practical triggering details and observed exploitation remain unconfirmed.
Researcher notes
The vulnerable condition is an omitted reference release after lookup returns a session whose state is invalid. The correction adds ksmbd_user_session_put on that path. No CWE is supplied. The bundle supports denial of service through resource leakage, but does not establish triggering frequency, exhaustion thresholds, crash behavior, or exploitation in the wild.
Mitigation direction
- Install a distribution kernel update containing the referenced stable ksmbd correction.
- Confirm backport status with the Linux distribution rather than relying solely on version numbers.
- Disable ksmbd where kernel-hosted SMB service is unnecessary.
- Restrict SMB access to trusted networks until patched.
- Monitor vendor guidance for revised affected-version information.
Validation and detection
- Determine whether ksmbd is enabled or loaded on each Linux system.
- Identify whether SMB service is reachable from untrusted network segments.
- Record exact kernel versions, distribution revisions, and backported patch status.
- Verify the installed kernel includes the referenced session-reference correction.
- Review telemetry for unexplained ksmbd resource growth or service disruption.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-71150 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/11fe566b442e3bc2774191740fd377739a87a1c0CVE reference, Linux
- https://git.kernel.org/stable/c/0fb87b28cafae71e9c8248432cc3a6a1fd759efcCVE reference, Linux
- https://git.kernel.org/stable/c/e54fb2a4772545701766cba08aab20de5eace8cdCVE reference, Linux
- https://git.kernel.org/stable/c/02e06785e85b4bd86ef3d23b7c8d87acc76773d5CVE reference, Linux
- https://git.kernel.org/stable/c/8cabcb4dd3dc85dd83a37d26efcc59a66a4074d7CVE reference, Linux
- https://git.kernel.org/stable/c/cafb57f7bdd57abba87725eb4e82bbdca4959644CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.