CVE-2025-71220
Published: 14 February 2026
Summary
CVE-2025-71220 is a high-severity an unspecified weakness vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-71220 is a vulnerability in the Linux kernel's ksmbd SMB server implementation. It arises from a failure to call ksmbd_session_rpc_close() on the error path in the create_smb2_pipe() function when ksmbd_iov_pin_rsp() fails, potentially leading to improper resource handling. The issue has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is tracked under NVD-CWE-noinfo. It affects Linux kernel versions with the ksmbd module enabled, prior to the application of relevant stable patches.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation enables high impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service within the affected kernel context.
Mitigation involves updating to a patched Linux kernel version, as detailed in the upstream stable commit references: https://git.kernel.org/stable/c/04dd114b682a4ccaeba2c2bad049c8b50ce740d8, https://git.kernel.org/stable/c/2b7b4df87fe6f2db6ee45f475de6b37b8b8e5d29, https://git.kernel.org/stable/c/7c28f8eef5ac5312794d8a52918076dcd787e53b, https://git.kernel.org/stable/c/a2c68e256fb7a4ac34154c6e865a1389acca839f, and https://git.kernel.org/stable/c/ac18761b530b5dd40f59af8a25902282e5512854. Security practitioners should verify kernel backports for their distributions and disable ksmbd if not required.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206990
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() When ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close().
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel vulnerability in ksmbd with low-priv access enabling high C/I/A impact directly maps to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the kernel flaw in ksmbd's create_smb2_pipe() error path by applying stable patches to prevent local privilege escalation and resource mishandling.
Restricts system to least functionality by disabling unnecessary kernel modules like ksmbd, eliminating exposure to this SMB server vulnerability.
Mandates secure error handling to ensure proper resource cleanup, such as calling ksmbd_session_rpc_close() on ksmbd_iov_pin_rsp() failure, avoiding leaks and compromise.