CVE-2022-47941

What it actually does

Omission of kfree in error paths during SMB2 negotiate handling in fs/ksmbd/smb2pdu.c causes a memory leak when certain invalid negotiation conditions are processed.

Why it matters to the business

Linux servers exposing ksmbd can experience gradual memory exhaustion leading to service degradation or crashes, increasing operational downtime risk on systems that have not applied the kernel fix.

How an attack unfolds

An attacker repeatedly sends crafted SMB2 negotiate requests that trigger the error conditions in smb2_handle_negotiate, causing the kernel to allocate memory without freeing it on each failure path, eventually exhausting available memory.

How to fix it

Upgrade the Linux kernel to a version containing commit aa7253c2393f6dcd6a1468b0792f6da76edad917 or later; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit aa7253c2393f6dcd6a1468b0792f6da76edad917 by inspecting the source tree or checking the kernel build log for the fix; re-test SMB2 negotiate error paths to verify no leaks remain.

Typical attack path

1. Identify Linux hosts running ksmbd with SMB ports exposed
2. Craft and send multiple SMB2 negotiate packets designed to hit the leaky error paths
3. Monitor target memory consumption over repeated requests
4. Continue until memory pressure causes service or system instability

How to detect it

Review system memory utilization trends and kernel slab allocator statistics during SMB traffic; correlate with SMB2 negotiate request volumes from untrusted sources.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all internet-facing or internal ksmbd servers
• Disable ksmbd where SMB services are not required
• Monitor memory usage on ksmbd hosts until patches are applied