LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71151: cifs: Fix memory and information leak in smb3_reconfigure()

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory and information leak in smb3_reconfigure() In smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the function returns immediately without freeing and erasing the newly allocated new_password and new_password2. This causes both a memory leak and a potential information leak. Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-71151 is a Linux kernel CIFS/SMB3 client bug where password buffers may not be wiped or freed after a specific reconfiguration failure. The main business concern is possible credential exposure, not demonstrated remote takeover. Public data provides no CVSS score and no KEV listing.

Executive priority

Patch during the next normal Linux maintenance window, faster for servers using SMB mounts with sensitive credentials. Escalate only if vendor advisories later confirm broader exploitability or active abuse.

Technical view

In smb3_reconfigure(), failure of smb3_sync_session_ctx_passwords() returns before kfree_sensitive() is called on new_password and new_password2. This creates a memory leak and potential information leak involving SMB credentials. Kernel stable commits are referenced as fixes, but the source bundle does not provide exploitability details.

Likely exposure

Exposure is most likely on Linux systems running affected kernel builds that use the CIFS/SMB3 client and perform mount reconfiguration involving passwords. Systems not using CIFS/SMB3 client functionality are less likely to be practically exposed.

Exploitation context

The source bundle states no active exploitation, and KEV is false. No public exploit path, CVSS vector, attacker prerequisites, or weaponized details are provided. Treat this as a credential-handling flaw requiring patch verification rather than an emergency exploitation event.

Researcher notes

Evidence is limited to the CVE description and upstream stable commit references. The bug is in kernel CIFS password-buffer cleanup on an error path. The bundle does not establish remote reachability, privilege requirements, memory disclosure mechanics, or affected distribution package mappings.

Mitigation direction

  • Identify Linux systems using CIFS/SMB3 client mounts.
  • Upgrade to a vendor kernel containing the referenced stable fixes.
  • Prioritize systems handling privileged or shared SMB credentials.
  • Follow distribution-specific advisories for exact fixed package versions.
  • Avoid unnecessary CIFS mount reconfiguration with passwords until patched.

Validation and detection

  • Check running kernel versions against distribution security advisories.
  • Confirm deployed kernels include the referenced upstream stable commits.
  • Inventory active CIFS/SMB3 mounts on Linux hosts.
  • Review whether SMB credentials are supplied during remount or reconfiguration workflows.
  • Validate patched hosts after reboot into the updated kernel.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-71151 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux880a661e67648a3ffe85405e8de5f50650a3c0b2, 0e4145774c016530bf99afb3675a1a0593c35642, 0f0e357902957fba28ed31bde0d6921c6bd1485d, 0f0e357902957fba28ed31bde0d6921c6bd1485d, 674ba43944dab8e8f87434e25d9d10c5152584bc, 6.6.64, 6.12.2, 6.11.11unaffected
LinuxLinux6.13, 0, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.