CVE-2025-39819

What it actually does

Inconsistent reference count update in smb2_compound_op on allocation failure of vars leads to missing cleanup of cfile reference and resulting resource leak.

Why it matters to the business

Over time, repeated triggering of the error path under memory pressure can exhaust kernel resources on systems performing SMB operations, degrading stability and availability of file services.

How an attack unfolds

A local attacker triggers smb2_compound_op under conditions that cause vars allocation to fail with -ENOMEM; because the error path skips the reference drop, the cfile reference is leaked. Existing callers do not compensate for the missing decrement.

How to fix it

Update the Linux kernel to a version containing commit 3fc11ff13fbc2749871d6ac2141685cf54699997 or later; for affected distributions apply the corresponding package update that includes this fix.

How to confirm the fix worked

Verify the running kernel contains commit 3fc11ff13fbc2749871d6ac2141685cf54699997; confirm smb2_compound_op always reaches the out label for cleanup on allocation failure.

Typical attack path

1. Obtain local access on a Linux system using the vulnerable kernel
2. Initiate SMB compound operations while inducing memory pressure to force -ENOMEM on vars allocation
3. Repeat to accumulate leaked references and exhaust resources

How to detect it

Inspect kernel logs and SMB trace points for repeated -ENOMEM returns from smb2_compound_op without corresponding reference decrements; correlate with increasing slab or file structure usage unrelated to workload growth.

What your security team should do

• Apply the kernel update containing the referenced commit as soon as possible
• Monitor systems for unexpected SMB-related resource usage until patches are deployed
• Review local SMB workloads for exposure to low-memory conditions