In the Linux kernel, the following vulnerability has been resolved:
cifs: fix double free race when mount fails in cifs_get_root()
When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free() which will free the context. In this situation we should not proceed to enter the out: section in cifs_smb3_do_mount() and free the same resources a second time.
[Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0
[Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G OE 5.17.0-rc3+ #4 [Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019 [Thu Feb 10 12:59:06 2022] Call Trace: [Thu Feb 10 12:59:06 2022] <IRQ> [Thu Feb 10 12:59:06 2022] dump_stack_lvl+0x5d/0x78 [Thu Feb 10 12:59:06 2022] print_address_description.constprop.0+0x24/0x150 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] kasan_report.cold+0x7d/0x117 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] __asan_load8+0x86/0xa0 [Thu Feb 10 12:59:06 2022] rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] rcu_core+0x547/0xca0 [Thu Feb 10 12:59:06 2022] ? call_rcu+0x3c0/0x3c0 [Thu Feb 10 12:59:06 2022] ? __this_cpu_preempt_check+0x13/0x20 [Thu Feb 10 12:59:06 2022] ? lock_is_held_type+0xea/0x140 [Thu Feb 10 12:59:06 2022] rcu_core_si+0xe/0x10 [Thu Feb 10 12:59:06 2022] __do_softirq+0x1d4/0x67b [Thu Feb 10 12:59:06 2022] __irq_exit_rcu+0x100/0x150 [Thu Feb 10 12:59:06 2022] irq_exit_rcu+0xe/0x30 [Thu Feb 10 12:59:06 2022] sysvec_hyperv_stimer0+0x9d/0xc0 ... [Thu Feb 10 12:59:07 2022] Freed by task 58179: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] kasan_set_track+0x25/0x30 [Thu Feb 10 12:59:07 2022] kasan_set_free_info+0x24/0x40 [Thu Feb 10 12:59:07 2022] ____kasan_slab_free+0x137/0x170 [Thu Feb 10 12:59:07 2022] __kasan_slab_free+0x12/0x20 [Thu Feb 10 12:59:07 2022] slab_free_freelist_hook+0xb3/0x1d0 [Thu Feb 10 12:59:07 2022] kfree+0xcd/0x520 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0x149/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae
[Thu Feb 10 12:59:07 2022] Last potentially related work creation: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] __kasan_record_aux_stack+0xb6/0xc0 [Thu Feb 10 12:59:07 2022] kasan_record_aux_stack_noalloc+0xb/0x10 [Thu Feb 10 12:59:07 2022] call_rcu+0x76/0x3c0 [Thu Feb 10 12:59:07 2022] cifs_umount+0xce/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] cifs_kill_sb+0xc8/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] deactivate_locked_super+0x5d/0xd0 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0xab9/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-coreUpgrade kernel-headersUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-docUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade python3-perfUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-cross-headersUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade bpftoolUpgrade kernel-rt-debugUpgrade kernel-rtUpgrade kernel-rt-develUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libs-devel | Jul 1, 2025 | Aug 22, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade perfUpgrade kernel-livepatch-5.10.106-102.504Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-livepatch-4.14.273-207.502Upgrade kernel-debuginfo | Sep 16, 2024 | Aug 22, 2024 |
| Debian | — | Upgrade linux | Aug 23, 2024 | Aug 22, 2024 |
| Dell Powerstore Dsa2025086 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Feb 20, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | Aug 22, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jun 26, 2025 | Aug 22, 2024 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade kernel-modules-extraUpgrade kernel-cross-headersUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-kvmUpgrade bpftool-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debug-coreUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-headersUpgrade bpftoolUpgrade kernel-debug-debuginfoUpgrade kernel-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-tools-libs-develUpgrade kernel-rt-develUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-debug-develUpgrade kernel-rt-kvmUpgrade kernel-debugUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade python3-perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-devel | Jul 31, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade linux-kvmUpgrade linux-hweUpgrade linux-gcp-4.15Upgrade linux-gcp-fipsUpgrade linux-hwe-5.4Upgrade linux-fipsUpgrade linux-bluefieldUpgrade linux-raspi-5.4Upgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-awsUpgrade linux-azure-4.15Upgrade linux-aws-hweUpgrade linuxUpgrade linux-intel-iotg-5.15Upgrade linux-iotUpgrade linux-gkeopUpgrade linux-ibm-5.4Upgrade linux-oracle-5.4Upgrade linux-azure-fipsUpgrade linux-azure-5.4Upgrade linux-azureUpgrade linux-ibmUpgrade linux-oracleUpgrade linux-aws-fipsUpgrade linux-azure-fde-5.15Upgrade linux-aws-5.4Upgrade linux-raspi | Nov 19, 2024 | Aug 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Aug 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub