PT-2025-49386 · Linux+3 · Linux Kernel+3

Published 2025-12-06 · Updated 2026-05-26 · CVE-2025-40285

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description A reference count leak exists in the smb2 sess setup() function within the SMB server component of the Linux kernel. Specifically, the reference count of ksmbd session can leak when a session requires reconnection. This is addressed by adding the missing ksmbd user session put() function call.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2025-40285

ECHO-435D-D7E3-8CEC

MGASA-2026-0017

MGASA-2026-0018

USN-8029-1

USN-8029-2

USN-8029-3

USN-8030-1

USN-8048-1

USN-8095-1

USN-8095-2

USN-8095-3

USN-8095-4

USN-8095-5

USN-8100-1

USN-8125-1

USN-8126-1

USN-8165-1

USN-8261-1

Affected Products

Debian

Linux Kernel

Linuxmint

Ubuntu

References · 1582

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40285.json · Exploit
• https://ubuntu.com/security/CVE-2025-40333 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40294 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68222 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38396 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38335 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38576 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40325 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38037 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40106 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40341 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39734 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22128 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68183 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-23157 · Vendor Advisory