In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double free of TCP_Server_Info::hostname
When shutting down the server in cifs_put_tcp_session(), cifsd thread might be reconnecting to multiple DFS targets before it realizes it should exit the loop, so @server->hostname can't be freed as long as cifsd thread isn't done. Otherwise the following can happen:
RIP: 0010:__slab_free+0x223/0x3c0 Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f> 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80 RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246 RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068 RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400 RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000 R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500 R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068 FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000) 000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4: PKRU: 55555554 Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? __reconnect_target_unlocked+0x3e/0x160 [cifs] ? __die_body.cold+0x8/0xd ? die+0x2b/0x50 ? do_trap+0xce/0x120 ? __slab_free+0x223/0x3c0 ? do_error_trap+0x65/0x80 ? __slab_free+0x223/0x3c0 ? exc_invalid_op+0x4e/0x70 ? __slab_free+0x223/0x3c0 ? asm_exc_invalid_op+0x16/0x20 ? __slab_free+0x223/0x3c0 ? extract_hostname+0x5c/0xa0 [cifs] ? extract_hostname+0x5c/0xa0 [cifs] ? __kmalloc+0x4b/0x140 __reconnect_target_unlocked+0x3e/0x160 [cifs] reconnect_dfs_server+0x145/0x430 [cifs] cifs_handle_standard+0x1ad/0x1d0 [cifs] cifs_demultiplex_thread+0x592/0x730 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0xdd/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 15, 2025 | Jan 31, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 31, 2025 |
| Suse | — | Upgrade dtb-mediatekUpgrade kernel-default-optionalUpgrade kernel-symsUpgrade kernel-syms-rtUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade kernel-devel-rtUpgrade kernel-macrosUpgrade dtb-hisiliconUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-rockchipUpgrade kernel-azure-vdsoUpgrade kernel-debugUpgrade dtb-armUpgrade kernel-defaultUpgrade dtb-socionextUpgrade dtb-nvidiaUpgrade cluster-md-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade kernel-rt-develUpgrade kernel-default-manUpgrade kernel-azure-develUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dtb-xilinxUpgrade dlm-kmp-rtUpgrade kernel-obs-qaUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade kernel-default-base-rebuildUpgrade kernel-default-extraUpgrade kernel-kvmsmallUpgrade kernel-source-azureUpgrade kernel-rt_debugUpgrade kernel-rt_debug-develUpgrade kernel-64kbUpgrade kernel-source-rtUpgrade kernel-docs-htmlUpgrade dlm-kmp-64kbUpgrade dtb-qcomUpgrade kernel-default-develUpgrade kernel-rtUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade dtb-sprdUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade cluster-md-kmp-rtUpgrade dtb-exynosUpgrade kernel-debug-develUpgrade dtb-appleUpgrade kernel-rt-optionalUpgrade dtb-broadcomUpgrade kernel-64kb-extraUpgrade dtb-lgUpgrade dtb-amdUpgrade kselftests-kmp-azureUpgrade kernel-develUpgrade kernel-default-vdsoUpgrade kernel-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-devel-azureUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade dtb-freescaleUpgrade dtb-alteraUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-sourceUpgrade kernel-debug-vdsoUpgrade dtb-allwinnerUpgrade kernel-kvmsmall-develUpgrade dtb-amazonUpgrade kernel-syms-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-azure-extraUpgrade dtb-renesasUpgrade dtb-caviumUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-azure | Mar 12, 2025 | Jan 31, 2025 |
| Ubuntu | — | Upgrade linux-image-nvidia-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1030-azure-fdeUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1027-oracleUpgrade linux-image-6.8.0-2024-raspi-realtimeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-62-genericUpgrade linux-image-6.8.0-1031-gcp-64kUpgrade linux-image-6.11.0-1020-oemUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.11.0-1013-gcpUpgrade linux-image-6.8.0-1029-nvidia-lowlatency-64kUpgrade linux-image-6.11.0-1012-lowlatencyUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidiaUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-1029-nvidia-64kUpgrade linux-image-realtimeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.11.0-1014-oracle-64kUpgrade linux-image-6.8.0-1029-oemUpgrade linux-image-ibm-classicUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-1013-azure-fdeUpgrade linux-image-6.8.0-1031-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1018-azure-nvidiaUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-6.8.0-1027-ibmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.11.0-24-generic-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-6.11.0-1011-raspiUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.11.0-1012-awsUpgrade linux-image-oem-22.04cUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1029-raspiUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1013-gkeopUpgrade linux-image-azure-nvidiaUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.11.0-1008-realtimeUpgrade linux-image-oem-24.04aUpgrade linux-image-oracle-64kUpgrade linux-image-6.11.0-1013-azureUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1030-awsUpgrade linux-image-6.8.0-1026-gkeUpgrade linux-image-oem-22.04dUpgrade linux-image-gkeopUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.11.0-24-genericUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-oem-24.04Upgrade linux-image-genericUpgrade linux-image-6.8.0-1030-aws-64kUpgrade linux-image-6.11.0-1013-gcp-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1029-nvidia-lowlatencyUpgrade linux-image-6.11.0-1014-oracleUpgrade linux-image-6.8.0-1027-oracle-64kUpgrade linux-image-azureUpgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1012-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-virtual-6.8Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-64-genericUpgrade linux-image-6.8.1-1023-realtimeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-6.8Upgrade linux-image-oracleUpgrade linux-image-6.8.0-62-generic-64kUpgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1029-nvidiaUpgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-62-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1030-azureUpgrade linux-image-6.8.0-62-lowlatency | Feb 11, 2025 | Jan 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub