Windows Server 2022 SMB SERVER (mrxsmb.sys) Memory leak

Question

In the Windows Server 2022 version（Microsoft Windows Server 2022 Datacenter 10.0.20348 Build 20348 ）, there is a problem that the memory of mrxsmb.sys CAN NOT be released. After running for a long time, it will cause the NoPageed memory area to be fully occupied, resulting in OOBE.

Specific Reproduction Steps

1. Upgrade WINDOWS SERVER to the latest patch. Currently, the last patch package is: KB5046616.
2. Execute sfc /scannow and DISM /Online /Cleanup-image /Restorehealth and then restart the system to ensure that there are no problems with the basic files of the system. (If it is a new system, this step can be skipped. This step is just to eliminate interference.)
3. Access an SMB directory with a large number of files in a local area network and continuously click on the subdirectories or files in the SMB directory to create a scenario of concentrated SMB access. (Because with a small amount of file access, it is not easy to detect this problem.)
4. Use the Memory Pool Monitor utility (Poolmon.exe) to track the memory. Under administrator privileges, enter the following commands: poolmon.exe -g "D:\Windows Kits\10\Debuggers\x64\triage\pooltag.txt" -d -iSmFi

At this time, it can be found that the Nonpaged driver memory with the TAG of SmFi has not been released (the value of Frees has always been 0, indicating no release, and Diff has been increasing continuously), and with the continuous SMB access, the memory usage (Allocs) keeps increasing.

MRXSMB.sys Version

===============

Answer 1

Hello 

Thank you for posting in Microsoft Community forum!

It looks like you're encountering a known memory leak issue with the mrxsmb.sys driver in Windows Server 2022, particularly after applying the latest patch KB5046616. This issue causes the nonpaged memory area to be fully occupied over time, leading to out-of-memory conditions.

To address this issue, you might want to check for any updates or hotfixes from Microsoft that specifically address memory leaks in the mrxsmb.sys driver. Additionally, you can monitor the Microsoft support page for any new resolutions or workarounds.

Resolved issues in Windows Server 2022 | Microsoft Learn

Best Regards,

Wesley Li

Answer 2

Thank you for your reply. However, there hasn't been any solution from Microsoft so far. The only feasible temporary measure is to restart the system regularly. But obviously, this is a terrible solution for the corporate environment, as employees may be working around the clock (we are a multinational enterprise and our employees are in different time zones).

It is hoped that a corrective patch can be released as soon as possible. Thank you.

Hello 

 

Thank you for posting in Microsoft Community forum!

It looks like you're encountering a known memory leak issue with the mrxsmb.sys driver in Windows Server 2022, particularly after applying the latest patch KB5046616. This issue causes the nonpaged memory area to be fully occupied over time, leading to out-of-memory conditions.

To address this issue, you might want to check for any updates or hotfixes from Microsoft that specifically address memory leaks in the mrxsmb.sys driver. Additionally, you can monitor the Microsoft support page for any new resolutions or workarounds.

Resolved issues in Windows Server 2022 | Microsoft Learn

Best Regards,

Wesley Li