In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in smb2_reconnect_server()
The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs_put_smb_ses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->ses_status again to something different than SES_EXITING.
To fix this, we need to make sure to unconditionally set @ses->ses_status to SES_EXITING and prevent any other threads from setting a new status while we're still tearing it down.
The following can be reproduced by adding some delay to right after the ipc is freed in __cifs_put_smb_ses() - which will give smb2_reconnect_server() worker a chance to run and then accessing @ses->ipc:
kinit ... mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10 [disconnect srv] ls /mnt/1 &>/dev/null sleep 30 kdestroy [reconnect srv] sleep 10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? die_addr+0x36/0x90 ? exc_general_protection+0x1c1/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? __list_del_entry_valid_or_report+0x33/0xf0 __cifs_put_smb_ses+0x1ae/0x500 [cifs] smb2_reconnect_server+0x4ed/0x710 [cifs] process_one_work+0x205/0x6b0 worker_thread+0x191/0x360 ? __pfx_worker_thread+0x10/0x10 kthread+0xe2/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-modules-extraUpgrade rtlaUpgrade kernel-64k-debug-develUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-64k-modules-extraUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-modulesUpgrade perfUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-uki-virtUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-docUpgrade python3-perfUpgrade libperfUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-coreUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-rt-modules-coreUpgrade kernel-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernelUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-64k-debugUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-cross-headersUpgrade kernel-modules-extraUpgrade kernel-64kUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rtUpgrade kernel-rt-debug-develUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-develUpgrade kernel-debug-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-headersUpgrade rv | Nov 4, 2024 | May 19, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-4.14.355-275.603Upgrade perfUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-livepatch-5.10.235-227.919Upgrade kernelUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.15.178-120.187Upgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade python-perfUpgrade kernel-livepatch-5.10.236-228.935Upgrade kernel-livepatch-5.10.234-225.921 | Mar 14, 2025 | May 19, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade perfUpgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-develUpgrade kernelUpgrade kernel-toolsUpgrade kernel-livepatch-6.1.112-122.189Upgrade bpftoolUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-modules-extra-common | Feb 17, 2025 | May 19, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jan 13, 2025 | May 19, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade python3-perf | Oct 8, 2024 | May 19, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel | Oct 9, 2024 | May 19, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 9, 2024 | May 19, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jun 27, 2024 | May 19, 2024 |
| Rocky_linux | — | Upgrade kernelUpgrade kernel-rt-modules-coreUpgrade kernel-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-debugUpgrade kernel-debug-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade kernel-tools-libsUpgrade kernel-rt-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modulesUpgrade rtlaUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-coreUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-coreUpgrade bpftoolUpgrade kernel-rt-debug-debuginfoUpgrade perfUpgrade kernel-uki-virtUpgrade kernel-rt-debuginfoUpgrade python3-perfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-coreUpgrade perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-zfcpdump-develUpgrade libperfUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-coreUpgrade rvUpgrade libperf-debuginfoUpgrade kernel-rtUpgrade kernel-headersUpgrade kernel-rt-modules | Jul 16, 2024 | May 19, 2024 |
| Suse | — | Upgrade kernel-azure-develUpgrade kernel-default-base-rebuildUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-baseUpgrade kernel-macrosUpgrade dtb-lgUpgrade kernel-rt-vdsoUpgrade kernel-sourceUpgrade cluster-md-kmp-azureUpgrade kernel-syms-rtUpgrade dtb-broadcomUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade kernel-default-livepatchUpgrade kernel-rt_debugUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-rtUpgrade gfs2-kmp-rtUpgrade kernel-syms-azureUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-default-extraUpgrade kernel-kvmsmallUpgrade kernel-rt-livepatch-develUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-rtUpgrade dtb-amlogicUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade dtb-qcomUpgrade dlm-kmp-azureUpgrade dlm-kmp-64kbUpgrade dtb-exynosUpgrade ocfs2-kmp-64kbUpgrade kernel-rtUpgrade kernel-rt-optionalUpgrade kernel-default-manUpgrade kernel-azure-vdsoUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-defaultUpgrade dtb-rockchipUpgrade kernel-source-azureUpgrade dtb-marvellUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-debug-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade kernel-azure-optionalUpgrade dtb-nvidiaUpgrade dtb-hisiliconUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-rt-livepatchUpgrade kernel-default-livepatch-develUpgrade dtb-alteraUpgrade dtb-socionextUpgrade cluster-md-kmp-64kbUpgrade kernel-symsUpgrade kernel-default-optionalUpgrade kernel-defaultUpgrade kernel-64kb-optionalUpgrade dtb-renesasUpgrade dtb-appleUpgrade cluster-md-kmp-rtUpgrade dtb-freescaleUpgrade kernel-debugUpgrade kernel-64kb-extraUpgrade gfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-debug-vdsoUpgrade kernel-rt-develUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-64kbUpgrade kernel-develUpgrade kernel-azure-extraUpgrade kernel-64kb-livepatch-develUpgrade kernel-docsUpgrade dtb-amdUpgrade dtb-caviumUpgrade ocfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-64kb-develUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-azureUpgrade dtb-xilinxUpgrade dtb-amazonUpgrade dlm-kmp-rtUpgrade dtb-mediatekUpgrade dtb-armUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-rtUpgrade kernel-source-vanilla | Jun 13, 2024 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-azureUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-lowlatency-64kUpgrade linux-image-awsUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gkeUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-virtualUpgrade linux-image-oem-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-ibm-classicUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-ibmUpgrade linux-image-intelUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-nvidia | Jul 12, 2024 | May 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 22, 2025 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub