CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink
Vulnerability summary
CVE-2025-40103 is a low (CVSS 2.0) vulnerability in linux. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.7% of scored vulnerabilities.
Not severe (CVSS 2, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 46 · Related 42Timeline
- 30-10-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.21% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu154 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-106.106 | < 6.17.0-14.14
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1050.53 | < 6.17.0-1007.7
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian1 product
- linux< 6.1.158-1 | < 6.12.57-1 | < 6.17.6-1
Linux1 product
- linux≥ 8ceb984379462f94bdebef3288d569c6e1f912ea, < d3c8ea197055c260119a13360e8202a27e53e1e4 | ≥ 8ceb984379462f94bdebef3288d569c6e1f912ea, < 790282abe9d805f08618c1c24ea2529e7259b692 | ≥ 8ceb984379462f94bdebef3288d569c6e1f912ea, < d7dd034c14928306db1b46be277ae439b84dacf9 | ≥ 8ceb984379462f94bdebef3288d569c6e1f912ea, < e15605b68b490186da2ad8029c0351a9cfb0b9af | ≥ 8ceb984379462f94bdebef3288d569c6e1f912ea, < 896bb31e1416f582503db1350cf1bd10dc64e5a6 | ≥ 8ceb984379462f94bdebef3288d569c6e1f912ea, < c2b77f42205ef485a647f62082c442c1cd69d3fc | 3.7
3 vendors · 156 products
