In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in smb2_reconnect_server()
The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs_put_smb_ses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->ses_status again to something different than SES_EXITING.
To fix this, we need to make sure to unconditionally set @ses->ses_status to SES_EXITING and prevent any other threads from setting a new status while we're still tearing it down.
The following can be reproduced by adding some delay to right after the ipc is freed in __cifs_put_smb_ses() - which will give smb2_reconnect_server() worker a chance to run and then accessing @ses->ipc:
kinit ... mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10 [disconnect srv] ls /mnt/1 &>/dev/null sleep 30 kdestroy [reconnect srv] sleep 10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? die_addr+0x36/0x90 ? exc_general_protection+0x1c1/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? __list_del_entry_valid_or_report+0x33/0xf0 __cifs_put_smb_ses+0x1ae/0x500 [cifs] smb2_reconnect_server+0x4ed/0x710 [cifs] process_one_work+0x205/0x6b0 worker_thread+0x191/0x360 ? __pfx_worker_thread+0x10/0x10 kthread+0xe2/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-debug-coreUpgrade rtlaUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modules-coreUpgrade python3-perfUpgrade perfUpgrade libperfUpgrade kernel-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-docUpgrade kernel-debug-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-debug-uki-virtUpgrade kernel-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel-toolsUpgrade kernel-zfcpdumpUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64kUpgrade kernel-debug-modules-coreUpgrade kernel-64k-coreUpgrade kernel-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-headersUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debugUpgrade kernel-rt-debug-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-coreUpgrade kernel-debug-modulesUpgrade rvUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-develUpgrade bpftool | Nov 4, 2024 | May 19, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-livepatch-5.10.234-225.921Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.15.178-120.187Upgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.236-228.935Upgrade kernel-toolsUpgrade python-perfUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-livepatch-5.10.235-227.919Upgrade kernelUpgrade bpftoolUpgrade perfUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-livepatch-4.14.355-275.603 | Mar 14, 2025 | May 19, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-livepatch-6.1.112-122.189Upgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-staticUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extra-commonUpgrade kernelUpgrade bpftoolUpgrade kernel-libbpfUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade kernel-debuginfo | Feb 17, 2025 | May 19, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jan 13, 2025 | May 19, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade python3-perfUpgrade kernel | Oct 8, 2024 | May 19, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel | Oct 9, 2024 | May 19, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 9, 2024 | May 19, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jun 27, 2024 | May 19, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-develUpgrade kernel-toolsUpgrade kernel-rt-coreUpgrade kernel-debug-devel-matchedUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade kernel-devel-matchedUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-develUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernel-headersUpgrade libperf-debuginfoUpgrade kernel-debug-develUpgrade kernel-modulesUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade libperfUpgrade perfUpgrade rvUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-debug-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-rt-debugUpgrade kernel-coreUpgrade rtlaUpgrade kernel-tools-libsUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade bpftoolUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modulesUpgrade kernelUpgrade kernel-debug-debuginfoUpgrade kernel-debug-coreUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-devel-matched | Jul 16, 2024 | May 19, 2024 |
| Suse | — | Upgrade kselftests-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-source-rtUpgrade dlm-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kernel-source-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-azureUpgrade kernel-rt_debugUpgrade kernel-debug-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-default-base-rebuildUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-kvmsmall-develUpgrade dtb-broadcomUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-obs-qaUpgrade dtb-marvellUpgrade dtb-exynosUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-64kbUpgrade dtb-apmUpgrade dtb-amlogicUpgrade kernel-macrosUpgrade kernel-rt-vdsoUpgrade kernel-syms-rtUpgrade kernel-azure-vdsoUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-64kbUpgrade dtb-lgUpgrade kernel-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-baseUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade kernel-sourceUpgrade kernel-default-manUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade dtb-caviumUpgrade dtb-sprdUpgrade dtb-alteraUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade kernel-64kb-optionalUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade gfs2-kmp-azureUpgrade dtb-socionextUpgrade reiserfs-kmp-rtUpgrade kernel-rt-develUpgrade kernel-default-vdsoUpgrade kernel-64kb-livepatch-develUpgrade dtb-mediatekUpgrade kernel-azure-extraUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-develUpgrade dtb-nvidiaUpgrade dtb-hisiliconUpgrade dlm-kmp-defaultUpgrade dtb-amazonUpgrade dlm-kmp-rtUpgrade dtb-armUpgrade kernel-devel-rtUpgrade kernel-default-baseUpgrade gfs2-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-azureUpgrade dtb-renesasUpgrade kernel-64kb-extraUpgrade gfs2-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-develUpgrade dtb-amdUpgrade kernel-debug-vdsoUpgrade dtb-allwinnerUpgrade reiserfs-kmp-defaultUpgrade kernel-azure-optionalUpgrade kernel-rt-livepatchUpgrade kernel-docsUpgrade kernel-default-livepatch-develUpgrade kernel-64kbUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-symsUpgrade dtb-freescaleUpgrade dtb-apple | Jun 13, 2024 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-raspiUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-generic-lpaeUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-azureUpgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-nvidia-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-ibmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-kvmUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-gkeUpgrade linux-image-oem-24.04Upgrade linux-image-genericUpgrade linux-image-intelUpgrade linux-image-oracle-64k | Jul 12, 2024 | May 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 22, 2025 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub