In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in decryption with multichannel
After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async decryption"), the channels started reusing AEAD TFM from primary channel to perform synchronous decryption, but that can't done as there could be multiple cifsd threads (one per channel) simultaneously accessing it to perform decryption.
This fixes the following KASAN splat when running fstest generic/249 with 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows Server 2022:
BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110 Read of size 8 at addr ffff8881046c18a0 by task cifsd/986 CPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 print_report+0x156/0x528 ? gf128mul_4k_lle+0xba/0x110 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? gf128mul_4k_lle+0xba/0x110 kasan_report+0xdf/0x1a0 ? gf128mul_4k_lle+0xba/0x110 gf128mul_4k_lle+0xba/0x110 ghash_update+0x189/0x210 shash_ahash_update+0x295/0x370 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_extract_iter_to_sg+0x10/0x10 ? ___kmalloc_large_node+0x10e/0x180 ? __asan_memset+0x23/0x50 crypto_ahash_update+0x3c/0xc0 gcm_hash_assoc_remain_continue+0x93/0xc0 crypt_message+0xe09/0xec0 [cifs] ? __pfx_crypt_message+0x10/0x10 [cifs] ? _raw_spin_unlock+0x23/0x40 ? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs] decrypt_raw_data+0x229/0x380 [cifs] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] ? __pfx_cifs_read_iter_from_socket+0x10/0x10 [cifs] smb3_receive_transform+0x837/0xc80 [cifs] ? __pfx_smb3_receive_transform+0x10/0x10 [cifs] ? __pfx___might_resched+0x10/0x10 ? __pfx_smb3_is_transform_hdr+0x10/0x10 [cifs] cifs_demultiplex_thread+0x692/0x1570 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? rcu_is_watching+0x20/0x50 ? rcu_lockdep_current_cpu_online+0x62/0xb0 ? find_held_lock+0x32/0x90 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xd/0xd0 ? trace_irq_enable.constprop.0+0xa8/0xe0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x60 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-develUpgrade rtlaUpgrade kernel-64kUpgrade kernel-rt-64k-debugUpgrade kernel-coreUpgrade kernel-rt-64k-develUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernelUpgrade kernel-rt-64k-coreUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade kernel-rt-64k-debug-develUpgrade kernel-tools-libsUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-cross-headersUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-kvmUpgrade kernel-debug-coreUpgrade kernel-64k-modules-extraUpgrade kernel-develUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-64k-debug-coreUpgrade kernel-64k-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-toolsUpgrade kernel-uki-virt-addonsUpgrade rvUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade libperfUpgrade kernel-rt-64kUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64k-debug-coreUpgrade kernel-modules-coreUpgrade kernel-64k-debugUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rtUpgrade kernel-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-headersUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-develUpgrade perfUpgrade kernel-docUpgrade kernel-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-core | Jul 4, 2025 | May 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade perfUpgrade kernelUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.242-239.961Upgrade bpftoolUpgrade kernel-livepatch-5.15.191-132.213Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade python-perf | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-perfUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade kernel-develUpgrade kernel6.12Upgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade perf6.12-debuginfoUpgrade perfUpgrade python3-perf6.12Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-develUpgrade kernel-debuginfoUpgrade kernel-livepatch-6.1.150-174.273Upgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.12.25-32.101Upgrade perf6.12Upgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf6.12-debuginfoUpgrade kernel-libbpfUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpf-static | Jul 11, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | May 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | May 1, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernel | Jun 17, 2025 | May 1, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debuginfoUpgrade kernel-rtUpgrade rvUpgrade kernel-debug-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libsUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-develUpgrade python3-perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-modules-extraUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade kernel-toolsUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-headersUpgrade kernel-rt-debug-kvmUpgrade kernel-debuginfoUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade perf-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-debuginfoUpgrade libperfUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-uki-virtUpgrade rtlaUpgrade kernel-cross-headersUpgrade kernelUpgrade libperf-debuginfoUpgrade kernel-modulesUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade kernel-rtUpgrade kernel-azure-optionalUpgrade kernel-obs-buildUpgrade ocfs2-kmp-64kbUpgrade kernel-docs-htmlUpgrade gfs2-kmp-defaultUpgrade dtb-renesasUpgrade dtb-socionextUpgrade kernel-azure-develUpgrade kernel-default-base-rebuildUpgrade dtb-broadcomUpgrade dtb-sprdUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-source-rtUpgrade kernel-default-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-develUpgrade cluster-md-kmp-rtUpgrade dtb-qcomUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade dtb-nvidiaUpgrade kselftests-kmp-rtUpgrade dtb-rockchipUpgrade kernel-rt-vdsoUpgrade kernel-rt_debugUpgrade kselftests-kmp-azureUpgrade kernel-default-livepatchUpgrade dtb-alteraUpgrade kernel-default-baseUpgrade dtb-marvellUpgrade dlm-kmp-defaultUpgrade kernel-rt-extraUpgrade dtb-caviumUpgrade kernel-source-vanillaUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-64kbUpgrade dtb-allwinnerUpgrade ocfs2-kmp-defaultUpgrade kernel-azureUpgrade ocfs2-kmp-azureUpgrade kernel-source-azureUpgrade dlm-kmp-64kbUpgrade kernel-default-develUpgrade gfs2-kmp-64kbUpgrade dtb-lgUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-docsUpgrade kernel-default-optionalUpgrade kernel-azure-vdsoUpgrade kernel-64kb-develUpgrade dlm-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-symsUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-rtUpgrade dtb-apmUpgrade dtb-amlogicUpgrade kernel-zfcpdumpUpgrade kernel-obs-qaUpgrade kernel-debugUpgrade kernel-azure-extraUpgrade kernel-64kb-optionalUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade kernel-syms-rtUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade dtb-amazonUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-debug-develUpgrade kernel-devel-rtUpgrade kernel-default-extraUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rt-develUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade dtb-armUpgrade reiserfs-kmp-defaultUpgrade kernel-sourceUpgrade kernel-macrosUpgrade kselftests-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-develUpgrade kernel-64kbUpgrade dtb-xilinx | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-genericUpgrade linux-image-ibm-classicUpgrade linux-image-nvidia-64kUpgrade linux-image-azure-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oem-22.04cUpgrade linux-image-oem-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-oem-24.04aUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-aws-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-64-genericUpgrade linux-image-oem-24.04Upgrade linux-image-raspiUpgrade linux-image-aws-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1031-oemUpgrade linux-image-gcp-64kUpgrade linux-image-generic-64kUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-gkeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gke-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-1029-oracleUpgrade linux-image-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-64-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1032-awsUpgrade linux-image-6.8.0-1034-azureUpgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-6.8.0-2026-raspi-realtimeUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-64-lowlatencyUpgrade linux-image-6.8.0-1029-oracle-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-fde-6.8Upgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-6.8.0-1029-ibmUpgrade linux-image-6.8.0-1032-aws-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.1-1025-realtimeUpgrade linux-image-6.8.0-1033-gcpUpgrade linux-image-6.8.0-1031-raspiUpgrade linux-image-6.8.0-1031-nvidiaUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.8.0-1015-gkeopUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-awsUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1031-nvidia-64kUpgrade linux-image-6.8.0-1028-gkeUpgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-virtualUpgrade linux-image-ibm-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1031-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-generic-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1033-gcp-64kUpgrade linux-image-6.8.0-1031-nvidia-lowlatency | Jun 26, 2025 | May 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub