In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double free of TCP_Server_Info::hostname
When shutting down the server in cifs_put_tcp_session(), cifsd thread might be reconnecting to multiple DFS targets before it realizes it should exit the loop, so @server->hostname can't be freed as long as cifsd thread isn't done. Otherwise the following can happen:
RIP: 0010:__slab_free+0x223/0x3c0 Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f> 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80 RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246 RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068 RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400 RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000 R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500 R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068 FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000) 000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4: PKRU: 55555554 Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? __reconnect_target_unlocked+0x3e/0x160 [cifs] ? __die_body.cold+0x8/0xd ? die+0x2b/0x50 ? do_trap+0xce/0x120 ? __slab_free+0x223/0x3c0 ? do_error_trap+0x65/0x80 ? __slab_free+0x223/0x3c0 ? exc_invalid_op+0x4e/0x70 ? __slab_free+0x223/0x3c0 ? asm_exc_invalid_op+0x16/0x20 ? __slab_free+0x223/0x3c0 ? extract_hostname+0x5c/0xa0 [cifs] ? extract_hostname+0x5c/0xa0 [cifs] ? __kmalloc+0x4b/0x140 __reconnect_target_unlocked+0x3e/0x160 [cifs] reconnect_dfs_server+0x145/0x430 [cifs] cifs_handle_standard+0x1ad/0x1d0 [cifs] cifs_demultiplex_thread+0x592/0x730 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0xdd/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 15, 2025 | Jan 31, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 31, 2025 |
| Suse | — | Upgrade ocfs2-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-sourceUpgrade ocfs2-kmp-defaultUpgrade kernel-64kbUpgrade kernel-debug-vdsoUpgrade dtb-freescaleUpgrade kernel-kvmsmall-vdsoUpgrade dtb-sprdUpgrade kernel-obs-buildUpgrade dtb-alteraUpgrade kernel-develUpgrade gfs2-kmp-defaultUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade gfs2-kmp-azureUpgrade kernel-rtUpgrade kernel-debug-develUpgrade kernel-rt-optionalUpgrade dtb-appleUpgrade dtb-exynosUpgrade cluster-md-kmp-rtUpgrade kernel-azure-optionalUpgrade kselftests-kmp-azureUpgrade dtb-marvellUpgrade dtb-broadcomUpgrade kernel-default-livepatchUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-64kbUpgrade dtb-allwinnerUpgrade kselftests-kmp-64kbUpgrade dtb-amazonUpgrade kernel-kvmsmall-develUpgrade kernel-azureUpgrade dtb-amdUpgrade kernel-default-vdsoUpgrade kernel-64kb-extraUpgrade kernel-source-vanillaUpgrade kernel-syms-azureUpgrade reiserfs-kmp-defaultUpgrade dtb-caviumUpgrade dtb-renesasUpgrade dtb-qcomUpgrade kernel-64kb-optionalUpgrade kernel-azure-extraUpgrade kernel-rt_debug-develUpgrade kernel-source-azureUpgrade kernel-rt_debugUpgrade kernel-source-rtUpgrade dlm-kmp-64kbUpgrade kernel-default-develUpgrade ocfs2-kmp-azureUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-syms-rtUpgrade kernel-obs-qaUpgrade dlm-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-azure-vdsoUpgrade kernel-macrosUpgrade kernel-default-baseUpgrade kernel-defaultUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade dtb-apmUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-rt-develUpgrade kernel-rt_debug-vdsoUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade dtb-armUpgrade kernel-default-livepatch-develUpgrade kernel-debugUpgrade dtb-rockchipUpgrade kernel-default-optionalUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade dtb-amlogicUpgrade kernel-default-manUpgrade dtb-nvidiaUpgrade dtb-hisiliconUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-azure-develUpgrade kernel-64kb-develUpgrade kernel-kvmsmallUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade dtb-socionextUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-azure | Mar 12, 2025 | Jan 31, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-6.11.0-1011-raspiUpgrade linux-image-6.11.0-1012-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04dUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1027-ibmUpgrade linux-image-6.8.0-1030-awsUpgrade linux-image-oem-24.04Upgrade linux-image-raspiUpgrade linux-image-azure-nvidiaUpgrade linux-image-6.11.0-24-genericUpgrade linux-image-6.8.0-1013-gkeopUpgrade linux-image-6.11.0-1008-realtimeUpgrade linux-image-kvmUpgrade linux-image-6.11.0-1014-oracleUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.1-1023-realtimeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-generic-64kUpgrade linux-image-gkeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1029-nvidia-lowlatencyUpgrade linux-image-6.11.0-1012-awsUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1030-aws-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-aws-64kUpgrade linux-image-gcpUpgrade linux-image-generic-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1027-oracle-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-6.11.0-1013-azureUpgrade linux-image-6.11.0-1013-gcp-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.11.0-24-generic-64kUpgrade linux-image-6.8.0-1026-gkeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-64-genericUpgrade linux-image-azureUpgrade linux-image-6.8.0-1029-raspiUpgrade linux-image-6.11.0-1013-azure-fdeUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1031-gcpUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1029-nvidiaUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-62-lowlatencyUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1030-azureUpgrade linux-image-generic-64k-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-62-lowlatency-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatencyUpgrade linux-image-realtimeUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-2024-raspi-realtimeUpgrade linux-image-lowlatency-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-62-generic-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1027-oracleUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1018-azure-nvidiaUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.11.0-1014-oracle-64kUpgrade linux-image-6.8.0-1029-oemUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oracleUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1031-gcp-64kUpgrade linux-image-6.11.0-1012-lowlatencyUpgrade linux-image-6.11.0-1013-gcpUpgrade linux-image-6.8.0-1029-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1030-azure-fdeUpgrade linux-image-6.11.0-1020-oemUpgrade linux-image-nvidiaUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-62-genericUpgrade linux-image-6.8.0-1029-nvidia-64kUpgrade linux-image-ibm-classicUpgrade linux-image-azure-fde-lts-24.04 | Feb 11, 2025 | Jan 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub