In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double free of TCP_Server_Info::hostname
When shutting down the server in cifs_put_tcp_session(), cifsd thread might be reconnecting to multiple DFS targets before it realizes it should exit the loop, so @server->hostname can't be freed as long as cifsd thread isn't done. Otherwise the following can happen:
RIP: 0010:__slab_free+0x223/0x3c0 Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f> 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80 RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246 RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068 RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400 RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000 R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500 R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068 FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000) 000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4: PKRU: 55555554 Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? __reconnect_target_unlocked+0x3e/0x160 [cifs] ? __die_body.cold+0x8/0xd ? die+0x2b/0x50 ? do_trap+0xce/0x120 ? __slab_free+0x223/0x3c0 ? do_error_trap+0x65/0x80 ? __slab_free+0x223/0x3c0 ? exc_invalid_op+0x4e/0x70 ? __slab_free+0x223/0x3c0 ? asm_exc_invalid_op+0x16/0x20 ? __slab_free+0x223/0x3c0 ? extract_hostname+0x5c/0xa0 [cifs] ? extract_hostname+0x5c/0xa0 [cifs] ? __kmalloc+0x4b/0x140 __reconnect_target_unlocked+0x3e/0x160 [cifs] reconnect_dfs_server+0x145/0x430 [cifs] cifs_handle_standard+0x1ad/0x1d0 [cifs] cifs_demultiplex_thread+0x592/0x730 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0xdd/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 15, 2025 | Jan 31, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 31, 2025 |
| Suse | — | Upgrade kernel-azureUpgrade kernel-develUpgrade dtb-amdUpgrade dtb-exynosUpgrade kernel-debug-develUpgrade gfs2-kmp-defaultUpgrade dtb-alteraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-optionalUpgrade kernel-debug-vdsoUpgrade kernel-64kb-extraUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade kernel-default-vdsoUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade reiserfs-kmp-64kbUpgrade dtb-marvellUpgrade kselftests-kmp-64kbUpgrade dtb-caviumUpgrade kernel-rt-vdsoUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-sourceUpgrade dtb-lgUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade kernel-docs-htmlUpgrade dtb-qcomUpgrade dtb-amazonUpgrade kernel-source-azureUpgrade kernel-rt_debugUpgrade kernel-64kbUpgrade dtb-allwinnerUpgrade kernel-rt_debug-develUpgrade kernel-devel-azureUpgrade dtb-sprdUpgrade ocfs2-kmp-64kbUpgrade kernel-rtUpgrade kernel-source-rtUpgrade kernel-default-develUpgrade dtb-appleUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-azureUpgrade kernel-azure-extraUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-azureUpgrade dtb-renesasUpgrade kernel-syms-azureUpgrade ocfs2-kmp-rtUpgrade dtb-socionextUpgrade kernel-rt-develUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade dtb-amlogicUpgrade kernel-default-manUpgrade dtb-nvidiaUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-default-optionalUpgrade dtb-mediatekUpgrade kernel-rt-livepatch-develUpgrade dtb-apmUpgrade kernel-azure-vdsoUpgrade kernel-default-baseUpgrade kernel-defaultUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade dtb-hisiliconUpgrade kernel-macrosUpgrade kernel-devel-rtUpgrade gfs2-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade dlm-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-docsUpgrade kernel-azure-develUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-develUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-debugUpgrade dtb-rockchipUpgrade dtb-armUpgrade gfs2-kmp-64kb | Mar 12, 2025 | Jan 31, 2025 |
| Ubuntu | — | Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1030-azure-fdeUpgrade linux-image-6.8.0-1027-oracleUpgrade linux-image-6.8.0-62-lowlatency-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-ibmUpgrade linux-image-6.8.0-62-generic-64kUpgrade linux-image-oracleUpgrade linux-image-azure-lts-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-62-lowlatencyUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1031-gcp-64kUpgrade linux-image-awsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.11.0-1013-azure-fdeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1029-nvidia-lowlatency-64kUpgrade linux-image-6.11.0-1013-gcpUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.11.0-1020-oemUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1029-oemUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1030-azureUpgrade linux-image-6.8.0-1031-gcpUpgrade linux-image-6.8.0-2024-raspi-realtimeUpgrade linux-image-6.11.0-1012-lowlatencyUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1029-nvidiaUpgrade linux-image-6.8.0-62-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.11.0-1014-oracle-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1018-azure-nvidiaUpgrade linux-image-oem-22.04aUpgrade linux-image-virtualUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1029-nvidia-64kUpgrade linux-image-6.11.0-1008-realtimeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-gcpUpgrade linux-image-generic-6.8Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1026-gkeUpgrade linux-image-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1030-aws-64kUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1030-awsUpgrade linux-image-6.11.0-1013-gcp-64kUpgrade linux-image-6.11.0-1012-awsUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-22.04cUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-kvmUpgrade linux-image-azure-nvidiaUpgrade linux-image-6.8.0-1013-gkeopUpgrade linux-image-6.8.0-1029-raspiUpgrade linux-image-6.8.0-64-genericUpgrade linux-image-6.11.0-24-generic-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1029-nvidia-lowlatencyUpgrade linux-image-6.11.0-1014-oracleUpgrade linux-image-azureUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.11.0-24-genericUpgrade linux-image-oem-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1027-ibmUpgrade linux-image-6.8.1-1023-realtimeUpgrade linux-image-6.8.0-1027-oracle-64kUpgrade linux-image-gkeUpgrade linux-image-gcp-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-6.11.0-1012-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-genericUpgrade linux-image-6.11.0-1013-azureUpgrade linux-image-oem-24.04aUpgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.11.0-1011-raspi | Feb 11, 2025 | Jan 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub