CVE-2025-40285

In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix possible refcount leak in smb2_sess_setup()

Reference count of ksmbd_session will leak when session need reconnect. Fix this by adding the missing ksmbd_user_session_put().

This vulnerability does not affect supported Red Hat Enterprise Linux releases because the in-kernel SMB server (ksmbd) is not enabled or provided in Red Hat kernels. In upstream kernels where this feature is compiled and active, unreleased session structures during reconnection events could allow a remote client to cause gradual resource depletion, resulting in a denial of service. Supported Red Hat environments rely on user-space implementations such as Samba for SMB network file sharing.