In the Linux kernel, the following vulnerability has been resolved:
cifs: prevent use-after-free by freeing the cfile later
In smb2_compound_op we have a possible use-after-free which can cause hard to debug problems later on.
This was revealed during stress testing with KASAN enabled kernel. Fixing it by moving the cfile free call to a few lines below, after the usage.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade bpftool-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-tools-develUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade kernel-libbpf-develUpgrade kernel-livepatch-6.1.41-63.109Upgrade kernel-debuginfo-common-x86_64Upgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-headers | Oct 16, 2025 | Sep 18, 2025 |
| Debian | — | Upgrade linux | Sep 22, 2025 | Sep 22, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub