In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in decryption with multichannel
After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async decryption"), the channels started reusing AEAD TFM from primary channel to perform synchronous decryption, but that can't done as there could be multiple cifsd threads (one per channel) simultaneously accessing it to perform decryption.
This fixes the following KASAN splat when running fstest generic/249 with 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows Server 2022:
BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110 Read of size 8 at addr ffff8881046c18a0 by task cifsd/986 CPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 print_report+0x156/0x528 ? gf128mul_4k_lle+0xba/0x110 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? gf128mul_4k_lle+0xba/0x110 kasan_report+0xdf/0x1a0 ? gf128mul_4k_lle+0xba/0x110 gf128mul_4k_lle+0xba/0x110 ghash_update+0x189/0x210 shash_ahash_update+0x295/0x370 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_extract_iter_to_sg+0x10/0x10 ? ___kmalloc_large_node+0x10e/0x180 ? __asan_memset+0x23/0x50 crypto_ahash_update+0x3c/0xc0 gcm_hash_assoc_remain_continue+0x93/0xc0 crypt_message+0xe09/0xec0 [cifs] ? __pfx_crypt_message+0x10/0x10 [cifs] ? _raw_spin_unlock+0x23/0x40 ? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs] decrypt_raw_data+0x229/0x380 [cifs] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] ? __pfx_cifs_read_iter_from_socket+0x10/0x10 [cifs] smb3_receive_transform+0x837/0xc80 [cifs] ? __pfx_smb3_receive_transform+0x10/0x10 [cifs] ? __pfx___might_resched+0x10/0x10 ? __pfx_smb3_is_transform_hdr+0x10/0x10 [cifs] cifs_demultiplex_thread+0x692/0x1570 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? rcu_is_watching+0x20/0x50 ? rcu_lockdep_current_cpu_online+0x62/0xb0 ? find_held_lock+0x32/0x90 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xd/0xd0 ? trace_irq_enable.constprop.0+0xa8/0xe0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x60 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rtlaUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-debug-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-coreUpgrade kernel-64k-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-64k-coreUpgrade kernel-coreUpgrade kernel-64k-modulesUpgrade python3-perfUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-develUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-debugUpgrade kernel-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64kUpgrade kernelUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-debug-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-cross-headersUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-debug-modulesUpgrade rvUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-kvmUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rtUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-coreUpgrade perfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-headersUpgrade kernel-uki-virtUpgrade kernel-rt-64k-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-64k-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-modules-coreUpgrade kernel-toolsUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-uki-virt-addonsUpgrade libperfUpgrade kernel-rt-64k | Jul 4, 2025 | May 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade python-perfUpgrade bpftoolUpgrade kernel-livepatch-5.15.191-132.213Upgrade kernel-toolsUpgrade kernel-livepatch-5.10.242-239.961Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-debuginfoUpgrade perfUpgrade kernel-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade kernel-tools-develUpgrade python3-perf6.12Upgrade kernel-tools-debuginfoUpgrade perf6.12-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade kernel-develUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-libbpf-debuginfoUpgrade kernel6.12Upgrade kernel-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade perf6.12Upgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.12.25-32.101Upgrade kernel-livepatch-6.1.150-174.273Upgrade kernel-libbpfUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-x86_64 | Jul 11, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | May 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | May 1, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Jun 17, 2025 | May 1, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade libperfUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-coreUpgrade libperf-debuginfoUpgrade kernel-modulesUpgrade kernelUpgrade perf-debuginfoUpgrade rtlaUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-debug-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-modules-coreUpgrade kernel-uki-virtUpgrade kernel-devel-matchedUpgrade kernel-tools-libsUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debugUpgrade kernel-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-develUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade perfUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-debug-coreUpgrade rvUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-coreUpgrade kernel-modules-extra | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade gfs2-kmp-64kbUpgrade kernel-devel-rtUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade kernel-docsUpgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-default-develUpgrade kernel-default-extraUpgrade kernel-default-optionalUpgrade kernel-source-azureUpgrade kernel-symsUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-rtUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade dtb-amazonUpgrade dtb-exynosUpgrade kernel-64kb-optionalUpgrade kernel-azure-extraUpgrade kernel-kvmsmallUpgrade dtb-freescaleUpgrade kernel-obs-qaUpgrade kernel-sourceUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade dtb-appleUpgrade kernel-rt-develUpgrade dtb-amdUpgrade dtb-armUpgrade kernel-kvmsmall-develUpgrade dtb-amlogicUpgrade dlm-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade dlm-kmp-azureUpgrade kernel-64kb-develUpgrade kernel-debug-develUpgrade kernel-syms-azureUpgrade kernel-debugUpgrade dtb-xilinxUpgrade kernel-64kbUpgrade dtb-mediatekUpgrade dtb-hisiliconUpgrade kernel-macrosUpgrade kernel-defaultUpgrade kernel-rt-vdsoUpgrade kernel-default-livepatchUpgrade dtb-broadcomUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-debug-vdsoUpgrade kernel-source-rtUpgrade gfs2-kmp-azureUpgrade kernel-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-vdsoUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-rt_debugUpgrade kselftests-kmp-rtUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade ocfs2-kmp-64kbUpgrade kernel-azureUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-azure-optionalUpgrade dtb-socionextUpgrade kernel-default-base-rebuildUpgrade dtb-sprdUpgrade dtb-renesasUpgrade kernel-docs-htmlUpgrade kernel-azure-develUpgrade gfs2-kmp-defaultUpgrade kernel-default-baseUpgrade dtb-marvellUpgrade kernel-rt-extraUpgrade dtb-caviumUpgrade dtb-alteraUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-source-vanillaUpgrade dtb-nvidiaUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade dtb-rockchipUpgrade kernel-64kb-extra | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1031-nvidia-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1028-gkeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-ibm-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1033-gcpUpgrade linux-image-oem-22.04dUpgrade linux-image-awsUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1031-raspiUpgrade linux-image-6.8.0-1033-gcp-64kUpgrade linux-image-azure-fde-6.8Upgrade linux-image-6.8.0-1031-nvidia-lowlatencyUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.14.0-1007-azureUpgrade linux-image-realtimeUpgrade linux-image-6.8.1-1025-realtimeUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-generic-6.8Upgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.8.0-1029-oracle-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1031-nvidia-lowlatency-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-64-lowlatencyUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1015-gkeopUpgrade linux-image-6.8.0-1029-ibmUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1032-aws-64kUpgrade linux-image-oracleUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1031-nvidiaUpgrade linux-image-azure-fdeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1032-awsUpgrade linux-image-6.8.0-1029-oracleUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-64-lowlatency-64kUpgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-6.8.0-1034-azureUpgrade linux-image-gcpUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-aws-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1031-oemUpgrade linux-image-gkeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-azure-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-aws-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-lowlatencyUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-ibmUpgrade linux-image-gke-6.8Upgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-2026-raspi-realtimeUpgrade linux-image-ibm-classicUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-genericUpgrade linux-image-gkeopUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-generic-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-oem-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-64-genericUpgrade linux-image-raspi-realtimeUpgrade linux-image-oem-22.04Upgrade linux-image-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-realtime-6.8.1Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-raspi | Jun 26, 2025 | May 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub