What’s Vulnerable › Vulnerabilities

CVE-2022-49938: cifs: fix small mempool leak in SMB2_negotiate()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-18 · updated 2026-06-17
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: fix small mempool leak in SMB2_negotiate() In some cases of failure (dialect mismatches) in SMB2_negotiate(), after the request is sent, the checks would return -EIO when they should be rather setting rc = -EIO and jumping to neg_exit to free the response buffer from mempool.

Affected products

• Linux kernel: before 5.15.66; from 5.16 before 5.19.8; 6.0-rc1, 6.0-rc2, 6.0-rc3 — fixed in 5.15.66, 5.19.8

How to fix

Upgrade to a fixed version: Linux kernel 5.15.66, 5.19.8. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/27893dfc1285f80f80f46b3b8c95f5d15d2e66d0
• https://git.kernel.org/stable/c/38a6b469bf22f153282fbe7d702a24e9eb43f50e
• https://git.kernel.org/stable/c/9e3c9efa7caf16e5acc05eab5e4d0a714e1610b0

Get alerted when CVE-2022-49938 or the next vulnerability affects your stack