CVE-2022-50856 cifs: Fix xid leak in cifs_ses_add_channel()

Not scored Published 30 Dec 2025 Updated 11 May 2026

A resource leak in the Linux kernel CIFS module allows attackers to cause a denial of service by exhausting transaction IDs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-50856?

CVE-2022-50856 is a denial of service vulnerability in Linux, published on 30 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix xid leak in cifs_ses_add_channel()

Before return, should free the xid, otherwise, the xid will be leaked.

Which versions are affected by CVE-2022-50856?

How do I fix CVE-2022-50856?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-50856 being exploited?

There is no known exploitation of CVE-2022-50856 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2022-50856, GHSA-x898-8j83-7w6w, UBUNTU-CVE-2022-50856.