boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-71204MEDIUM
Linux Linux — smb/server: fix refcount leak in parse_durable_handle_context()
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  N  H    5.5   .0028   20.5     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    8df4bcdb0a4232192b2445256c39b787d58ef14d –  —
  Linux    6.9 –                                       6.6.124
TIMELINE
  Jan 31  Reserved by Linux
  Feb 14  Published (CNA: Linux)
  Jul 30  RESCORED — CVE-2025-71204 (Linux). CVSS 7.5 → 5.5 (NVD).
CNA: Linux · CVSS v3.1 · 4 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix refcount leak in parse_durable_handle_context() When the command is a replay operation and -ENOEXEC is returned, the refcount of ksmbd_file must be released.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
January 31, 2026ReservedReserved by Linux
February 14, 2026PublishedPublished (CNA: Linux)
July 30, 2026RESCOREDRESCORED — CVE-2025-71204 (Linux). CVSS 7.5 → 5.5 (NVD).

Affected

Affected products and packages — 2 rows
VendorProduct / PackageEcosystemVersion introducedFixed
LinuxLinux8df4bcdb0a4232192b2445256c39b787d58ef14d
LinuxLinux6.96.6.124

References (4)

Related

Authoritative record: CVE-2025-71204 at cve.org

Vendors: linux

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-71204 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.