---
id: CVE-2025-39929
title: 'smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path

  During tests of another unrelated patch I was able to trigger this
  error: Objects remaining on _…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 <
    5aa69aabcb275a8012265233c7694076ce1d9102
  - >-
    Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 <
    aa4cf7615328eae44f3b4bf5f4fde3fb390c27c6
  - >-
    Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 <
    3d7c075c878ac844e33c43e506c2fa27ac7e9689
  - >-
    Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 <
    e7b7a93879558e77d950f1ff9a6f3daa385b33df
  - >-
    Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 <
    922338efaad63cfe30d459dfc59f9d69ff93ded4
  - >-
    Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 <
    0991418bf98f191d0c320bd25245fcffa1998c7e
  - >-
    Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 <
    daac51c7032036a0ca5f1aa419ad1b0471d1c6e0
  - Linux 4.16
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:54:41.432354Z'
published: '2025-10-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:33.170Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39929'
references:
  - url: 'https://git.kernel.org/stable/c/5aa69aabcb275a8012265233c7694076ce1d9102'
  - url: 'https://git.kernel.org/stable/c/aa4cf7615328eae44f3b4bf5f4fde3fb390c27c6'
  - url: 'https://git.kernel.org/stable/c/3d7c075c878ac844e33c43e506c2fa27ac7e9689'
  - url: 'https://git.kernel.org/stable/c/e7b7a93879558e77d950f1ff9a6f3daa385b33df'
  - url: 'https://git.kernel.org/stable/c/922338efaad63cfe30d459dfc59f9d69ff93ded4'
  - url: 'https://git.kernel.org/stable/c/0991418bf98f191d0c320bd25245fcffa1998c7e'
  - url: 'https://git.kernel.org/stable/c/daac51c7032036a0ca5f1aa419ad1b0471d1c6e0'
tags:
  - cve.org
epss: 0.00314
epssPercentile: 0.24122
ingestedAt: '2026-10-15T05:52:46.075Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path

During tests of another unrelated patch I was able to trigger this
error: Objects remaining on __kmem_cache_shutdown()

## Affected

- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 5aa69aabcb275a8012265233c7694076ce1d9102`
- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < aa4cf7615328eae44f3b4bf5f4fde3fb390c27c6`
- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 3d7c075c878ac844e33c43e506c2fa27ac7e9689`
- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < e7b7a93879558e77d950f1ff9a6f3daa385b33df`
- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 922338efaad63cfe30d459dfc59f9d69ff93ded4`
- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 0991418bf98f191d0c320bd25245fcffa1998c7e`
- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < daac51c7032036a0ca5f1aa419ad1b0471d1c6e0`
- `Linux 4.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.