In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in async decryption
Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API.
Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ================================================================== [ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110 [ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899 [ 194.197707] [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs] [ 194.200032] Call Trace: [ 194.200191] <TASK> [ 194.200327] dump_stack_lvl+0x4e/0x70 [ 194.200558] ? gf128mul_4k_lle+0xc1/0x110 [ 194.200809] print_report+0x174/0x505 [ 194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 194.201352] ? srso_return_thunk+0x5/0x5f [ 194.201604] ? __virt_addr_valid+0xdf/0x1c0 [ 194.201868] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202128] kasan_report+0xc8/0x150 [ 194.202361] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202616] gf128mul_4k_lle+0xc1/0x110 [ 194.202863] ghash_update+0x184/0x210 [ 194.203103] shash_ahash_update+0x184/0x2a0 [ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10 [ 194.203651] ? srso_return_thunk+0x5/0x5f [ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340 [ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140 [ 194.204434] crypt_message+0xec1/0x10a0 [cifs] [ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs] [ 194.208507] ? srso_return_thunk+0x5/0x5f [ 194.209205] ? srso_return_thunk+0x5/0x5f [ 194.209925] ? srso_return_thunk+0x5/0x5f [ 194.210443] ? srso_return_thunk+0x5/0x5f [ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs] [ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] [ 194.214670] ? srso_return_thunk+0x5/0x5f [ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs]
This is because TFM is being used in parallel.
Fix this by allocating a new AEAD TFM for async decryption, but keep the existing one for synchronous READ cases (similar to what is done in smb3_calc_signature()).
Also remove the calls to aead_request_set_callback() and crypto_wait_req() since it's always going to be a synchronous operation.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade bpftoolUpgrade kernel-livepatch-5.10.237-230.949Upgrade kernelUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.184-125.190Upgrade bpftool-debuginfoUpgrade python-perf | May 30, 2025 | Oct 21, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-libbpf-develUpgrade kernel-modules-extra-commonUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade python3-perfUpgrade kernel-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-develUpgrade kernelUpgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-livepatch-6.1.128-136.201Upgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade python3-perf-debuginfo | Feb 26, 2025 | Oct 21, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Feb 10, 2025 | Oct 21, 2024 |
| Dell Powerstore Dsa2025223 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 27, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perf | Feb 11, 2025 | Oct 21, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelists | Feb 11, 2025 | Oct 21, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Jul 17, 2025 | Oct 21, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | May 15, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-gkeop-5.15Upgrade linux-image-5.4.0-219-genericUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-5.15.0-1083-raspiUpgrade linux-image-5.15.0-1084-oracleUpgrade linux-image-6.8.0-56-lowlatency-64kUpgrade linux-image-aws-fips-5.15Upgrade linux-image-5.15.0-1086-gcp-fipsUpgrade linux-image-oem-22.04cUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-5.4.0-1151-gcp-fipsUpgrade linux-image-aws-fipsUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-5.15.0-1081-nvidia-lowlatencyUpgrade linux-image-gcp-fips-5.4Upgrade linux-image-5.4.0-1154-azure-fipsUpgrade linux-image-5.4.0-1066-xilinx-zynqmpUpgrade linux-image-5.4.0-1151-gcpUpgrade linux-image-raspi-5.15Upgrade linux-image-kvmUpgrade linux-image-6.8.0-57-genericUpgrade linux-image-aws-lts-24.04Upgrade linux-image-gkeUpgrade linux-image-xilinx-zynqmp-5.4Upgrade linux-image-azure-cvmUpgrade linux-image-raspiUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-1022-oracleUpgrade linux-image-lowlatency-5.4Upgrade linux-image-5.15.0-1087-aws-64kUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-1082-intel-iotgUpgrade linux-image-5.15.0-143-generic-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1092-azureUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-6.8.0-1008-gkeopUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-64kUpgrade linux-image-gcp-5.15Upgrade linux-image-nvidia-5.15Upgrade linux-image-aws-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-143-generic-lpaeUpgrade linux-image-5.4.0-1094-ibmUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-fips-5.15Upgrade linux-image-oemUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-56-generic-64kUpgrade linux-image-azure-fips-5.4Upgrade linux-image-5.4.0-1052-iotUpgrade linux-image-5.15.0-143-fipsUpgrade linux-image-5.15.0-1040-nvidia-tegra-rtUpgrade linux-image-5.15.0-1087-aws-fipsUpgrade linux-image-5.15.0-1051-xilinx-zynqmpUpgrade linux-image-5.4.0-1146-oracleUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-virtual-5.15Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-nvidia-6.8Upgrade linux-image-gcp-fips-5.15Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-6.8.1-1018-realtimeUpgrade linux-image-6.8.0-1025-awsUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-5.4.0-219-generic-lpaeUpgrade linux-image-5.15.0-1081-nvidiaUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-oem-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-ibm-5.15Upgrade linux-image-oracle-5.15Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-5.15Upgrade linux-image-generic-64k-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-6.8.0-56-lowlatencyUpgrade linux-image-6.8.0-1025-azureUpgrade linux-image-5.15.0-143-lowlatencyUpgrade linux-image-aws-fips-5.4Upgrade linux-image-generic-lpae-5.4Upgrade linux-image-intel-iotgUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.4.0-1107-bluefieldUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-5.15.0-1079-ibmUpgrade linux-image-raspi-5.4Upgrade linux-image-5.4.0-219-lowlatencyUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-5.15Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-5.15.0-1083-kvmUpgrade linux-image-5.4.0-1148-awsUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-awsUpgrade linux-image-aws-5.4Upgrade linux-image-gcp-5.4Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1024-nvidia-lowlatencyUpgrade linux-image-6.8.0-1021-gkeUpgrade linux-image-5.15.0-1086-gcpUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-nvidiaUpgrade linux-image-fips-5.15Upgrade linux-image-5.4.0-1122-fipsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibm-5.4Upgrade linux-image-oem-24.04aUpgrade linux-image-snapdragon-5.4Upgrade linux-image-gke-5.15Upgrade linux-image-azure-5.4Upgrade linux-image-intelUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1024-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1040-nvidia-tegraUpgrade linux-image-azure-fipsUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1024-oemUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1094-azure-fipsUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1069-gkeopUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-fips-5.4Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-raspi-nolpaeUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-genericUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.15.0-143-lowlatency-64kUpgrade linux-image-5.15.0-1083-intel-iotgUpgrade linux-image-5.4.0-1148-aws-fipsUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-6.8.0-1026-gcp-64kUpgrade linux-image-oem-osp1Upgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-5.15.0-1080-intel-iot-realtimeUpgrade linux-image-5.15.0-1084-gkeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-raspi2Upgrade linux-image-generic-64kUpgrade linux-image-azure-nvidiaUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-6.8.0-1024-nvidia-64kUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-5.4.0-1131-raspiUpgrade linux-image-gkeopUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-5.15.0-1087-realtimeUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-5.15.0-1094-azureUpgrade linux-image-gcpUpgrade linux-image-virtualUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1022-oracle-64kUpgrade linux-image-fipsUpgrade linux-image-oem-20.04bUpgrade linux-image-aws-64k-5.15Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1026-gcpUpgrade linux-image-5.4.0-1153-azureUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-oem-20.04dUpgrade linux-image-aws-lts-22.04Upgrade linux-image-kvm-5.15Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-raspi-realtimeUpgrade linux-image-azure-fdeUpgrade linux-image-generic-5.4Upgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-5.15.0-1029-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-143-genericUpgrade linux-image-oracle-5.4Upgrade linux-image-6.8.0-1024-nvidiaUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1029-nvidia-tegra-igxUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-5.15.0-1087-awsUpgrade linux-image-kvm-5.4Upgrade linux-image-6.8.0-56-genericUpgrade linux-image-nvidia-tegraUpgrade linux-image-ibm-classicUpgrade linux-image-generic-lpaeUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-bluefieldUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-virtual-5.4Upgrade linux-image-lowlatency-64kUpgrade linux-image-5.4.0-1135-kvmUpgrade linux-image-gkeop-6.8Upgrade linux-image-generic-5.15Upgrade linux-image-bluefield-5.4 | Feb 20, 2025 | Oct 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub