CVE-2025-71151

A memory and information leak vulnerability was found in the Linux kernel's CIFS/SMB3 filesystem driver. When smb3_reconfigure() fails during smb3_sync_session_ctx_passwords(), the newly allocated password buffers (new_password and new_password2) are not freed or securely erased. This causes a memory leak and leaves sensitive password data in kernel memory that could potentially be exposed.

This vulnerability affects systems using CIFS/SMB3 filesystem mounts with password-based authentication. The password buffers remain in kernel memory after the error, creating an information disclosure risk if kernel memory can be read through other means. The memory leak accumulates with each failed reconfigure operation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.