Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2025-40285 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix possible refcount leak in smb2_sess_setup() Reference count of ksmbd_session will leak when session need reconnect. Fix this by adding the missing ksmbd_user_session_put().

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA: kernel.orgCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/379510a815cb2e64eb0a379cb62295d6ade65df0 kernel.orgSource CodeVendor
https://git.kernel.org/stable/c/6fc935f798d44a8eb8a5e6659198399fbf57b981 kernel.orgSource CodeVendor
https://git.kernel.org/stable/c/d37b2c81c83d6c0d5ca582f4fe73c672983f9e0d kernel.orgSource CodeVendor
https://git.kernel.org/stable/c/dcc51dfe6ff26b52cac106865a172ac982d78401 kernel.orgSource CodeVendor
https://git.kernel.org/stable/c/e671f9bb97805771380c98de944e2ceab6949188 kernel.orgSource CodeVendor

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

ProductVersions
Linux kernel
All versions

CPE

  • cpe:2.3:o:kernel:linux_kernel:*:*:*:*:*:*:*:*
  • cpe:2.3:o:linux:kernel:*:*:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:endpoint_security_linux_threat_prevention:*:*
  • cpe:2.3:a:linux:linux_kernel:*:*:*:*:*:*:*:*

Remediation

Change History

3 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2025-40285
NVD Published Date:
Dec 6, 2025
NVD Last Modified:
Jul 30, 2026
Source:
kernel.org
CVE-2025-40285 Details - Not Deferred