CVE-2026-23228

What it actually does

Failure path in ksmbd_tcp_new_connection() calls free_transport() instead of ksmbd_tcp_disconnect() after kthread_run() fails, leaving the active_num_conn counter incremented and never decremented.

Why it matters to the business

Over repeated connection setup failures the kernel's SMB server connection accounting drifts, which can eventually block new legitimate connections or trigger unexpected resource limits in high-volume file-serving environments.

How an attack unfolds

An attacker with local access repeatedly triggers kthread_run() failures during inbound SMB connection attempts; each failure leaks one count from active_num_conn until the server refuses further connections or hits internal limits.

How to fix it

Upgrade the Linux kernel to a fixed release (5.15.201 or later, or the commit 6dd2645cf080a75be31fa66063c7332b291f46f0) and reboot. Rebuild and redeploy any custom kernels that include the ksmbd server code.

How to confirm the fix worked

Confirm the running kernel version contains the fix commit or is at least 5.15.201; inspect ksmbd_tcp_new_connection() to verify ksmbd_tcp_disconnect() is called on kthread_run() failure; monitor active_num_conn via debugfs or kernel counters under load.

Typical attack path

1. Obtain local shell or unprivileged process on a system running the vulnerable ksmbd module
2. Force repeated kthread_run() failures while opening SMB connections (e.g., via resource exhaustion or timing)
3. Observe active_num_conn counter growth until new connections are rejected
4. Continue until service availability is impacted

How to detect it

Review kernel logs for repeated ksmbd_tcp_new_connection failures followed by connection counts that never decrease; correlate with SMB connection attempts that terminate abnormally; no remote network indicators exist.

What your security team should do

• Apply the kernel update to all affected systems within the next maintenance window
• Prioritize systems that expose ksmbd to untrusted networks or handle high connection rates
• Add kernel version checks to vulnerability scanners and asset inventories
• Review any downstream distributions or embedded products that ship the affected ksmbd code