In the Linux kernel, the following vulnerability has been resolved:
cifs: prevent use-after-free by freeing the cfile later
In smb2_compound_op we have a possible use-after-free which can cause hard to debug problems later on.
This was revealed during stress testing with KASAN enabled kernel. Fixing it by moving the cfile free call to a few lines below, after the usage.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade kernelUpgrade python3-perf-debuginfoUpgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.1.41-63.109Upgrade kernel-libbpf-develUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade python3-perf | Oct 16, 2025 | Sep 18, 2025 |
| Debian | — | Upgrade linux | Sep 22, 2025 | Sep 22, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub