Not yet scoredPublished Oct 30, 2025

CVE-2025-40103smb: client: Fix refcount leak for cifs_sb_tlink

Updated under an hour ago (Oct 26, 2026, 10:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8ceb984379462f94bdebef3288d569c6e1f912ea before d3c8ea197055c260119a13360e8202a27e53e1e4; from 8ceb984379462f94bdebef3288d569c6e1f912ea before 790282abe9d805f08618c1c24ea2529e7259b692; from 8ceb984379462f94bdebef3288d569c6e1f912ea before d7dd034c14928306db1b46be277ae439b84dacf9; from 8ceb984379462f94bdebef3288d569c6e1f912ea before e15605b68b490186da2ad8029c0351a9cfb0b9af; from 8ceb984379462f94bdebef3288d569c6e1f912ea before 896bb31e1416f582503db1350cf1bd10dc64e5a6; from 8ceb984379462f94bdebef3288d569c6e1f912ea before c2b77f42205ef485a647f62082c442c1cd69d3fc	CNA record

References

References

https://git.kernel.org/stable/c/d3c8ea197055c260119a13360e8202a27e53e1e4
https://git.kernel.org/stable/c/790282abe9d805f08618c1c24ea2529e7259b692
https://git.kernel.org/stable/c/d7dd034c14928306db1b46be277ae439b84dacf9
https://git.kernel.org/stable/c/e15605b68b490186da2ad8029c0351a9cfb0b9af
https://git.kernel.org/stable/c/896bb31e1416f582503db1350cf1bd10dc64e5a6
https://git.kernel.org/stable/c/c2b77f42205ef485a647f62082c442c1cd69d3fc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.