High 7.8Published Feb 14, 2026

CVE-2025-71220smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()

Updated under an hour ago (Oct 27, 2026, 4:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() When ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close().

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 23, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f2283680a80571ca82d710bc6ecd8f8beac67d63 before a2c68e256fb7a4ac34154c6e865a1389acca839f; 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 builds before 2b7b4df87fe6f2db6ee45f475de6b37b8b8e5d29; from e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d before 04dd114b682a4ccaeba2c2bad049c8b50ce740d8; from e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d before ac18761b530b5dd40f59af8a25902282e5512854; from e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d before fdda836fcee6fdbcccc24e3679097efb583f581f; from e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d before 7c28f8eef5ac5312794d8a52918076dcd787e53b; from 5.15.145 before 5.15.200; from 6.1.71 before 6.1.163	CNA record
linux linux_kernel linux:linux_kernel	from 5.15.145 before 5.15.200; from 6.1.71 before 6.1.163; from 6.6 before 6.6.124; from 6.7 before 6.12.70; from 6.13 before 6.18.10; 6.19; 6.19; 6.19	NVD

References

References

https://git.kernel.org/stable/c/a2c68e256fb7a4ac34154c6e865a1389acca839f	patch
https://git.kernel.org/stable/c/2b7b4df87fe6f2db6ee45f475de6b37b8b8e5d29	patch
https://git.kernel.org/stable/c/04dd114b682a4ccaeba2c2bad049c8b50ce740d8	patch
https://git.kernel.org/stable/c/ac18761b530b5dd40f59af8a25902282e5512854	patch
https://git.kernel.org/stable/c/fdda836fcee6fdbcccc24e3679097efb583f581f	patch
https://git.kernel.org/stable/c/7c28f8eef5ac5312794d8a52918076dcd787e53b	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.