LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23228: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter. Replace free_transport() with ksmbd_tcp_disconnect().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the in-kernel SMB server, ksmbd. Under a thread-start failure path, the server can leak its active connection counter instead of decrementing it. The public record does not provide a CVSS score, impact rating, or evidence of active exploitation.

Executive priority

Treat this as a tracked kernel maintenance issue unless ksmbd is used on exposed SMB services or affected appliances. There is not enough public evidence to justify emergency response, but kernel and firmware updates should be planned through normal security patch cycles.

Technical view

In ksmbd_tcp_new_connection(), kthread_run() failure freed the transport with free_transport(), which did not decrement active_num_conn. The resolved change uses ksmbd_tcp_disconnect(), preserving connection counter cleanup. The CVE record lists Linux kernel versions and stable commits, but provides no CWE, CVSS, or detailed exploitability assessment.

Likely exposure

Exposure is likely limited to Linux systems or embedded products using the ksmbd in-kernel SMB server on affected kernel builds. Systems not running ksmbd are less likely to be exposed. The bundle also references a Siemens advisory, so managed appliances should be checked through vendor firmware guidance.

Exploitation context

The source bundle does not show KEV listing, active exploitation, public exploit availability, or a complete attack scenario. The described failure path suggests operational impact may depend on triggering kthread_run() failure conditions, but the sources do not quantify likelihood or business impact.

Researcher notes

The vulnerability is a cleanup-path accounting bug in ksmbd connection handling. Key evidence is the kernel description: free_transport() did not decrement active_num_conn after kthread_run() failure, and the fix switches to ksmbd_tcp_disconnect(). Missing data includes CVSS, CWE, exploitability, and concrete product impact.

Mitigation direction

  • Apply Linux stable kernel updates containing the referenced ksmbd fix.
  • Use distribution or appliance vendor advisories for backported fixed builds.
  • Check Siemens guidance if affected Siemens products are in scope.
  • Prioritize externally reachable or partner-facing SMB services for review.
  • Track this CVE until CVSS and vendor impact statements are published.

Validation and detection

  • Inventory Linux hosts and appliances running the ksmbd SMB server.
  • Record kernel versions and compare against vendor fixed packages.
  • Review whether exposed SMB services rely on ksmbd rather than Samba.
  • Check asset vendors for firmware advisories referencing CVE-2026-23228.
  • Monitor kernel and CVE records for updated severity information.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23228 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4210c3555db4b38bade92331b153e583261f05f9, d5d7847e57ac69fa99c18b363a34419bcdb5a281, 0d0d4680db22eda1eea785c47bbf66a9b33a8b16, 0d0d4680db22eda1eea785c47bbf66a9b33a8b16, 0d0d4680db22eda1eea785c47bbf66a9b33a8b16, 0d0d4680db22eda1eea785c47bbf66a9b33a8b16, 0d0d4680db22eda1eea785c47bbf66a9b33a8b16, 5.15.91, 6.1.9unaffected
LinuxLinux6.2, 0, 5.15.201, 6.1.164, 6.6.125, 6.12.72, 6.18.11, 6.19.1, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.