In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in decryption with multichannel
After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async decryption"), the channels started reusing AEAD TFM from primary channel to perform synchronous decryption, but that can't done as there could be multiple cifsd threads (one per channel) simultaneously accessing it to perform decryption.
This fixes the following KASAN splat when running fstest generic/249 with 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows Server 2022:
BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110 Read of size 8 at addr ffff8881046c18a0 by task cifsd/986 CPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 print_report+0x156/0x528 ? gf128mul_4k_lle+0xba/0x110 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? gf128mul_4k_lle+0xba/0x110 kasan_report+0xdf/0x1a0 ? gf128mul_4k_lle+0xba/0x110 gf128mul_4k_lle+0xba/0x110 ghash_update+0x189/0x210 shash_ahash_update+0x295/0x370 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_extract_iter_to_sg+0x10/0x10 ? ___kmalloc_large_node+0x10e/0x180 ? __asan_memset+0x23/0x50 crypto_ahash_update+0x3c/0xc0 gcm_hash_assoc_remain_continue+0x93/0xc0 crypt_message+0xe09/0xec0 [cifs] ? __pfx_crypt_message+0x10/0x10 [cifs] ? _raw_spin_unlock+0x23/0x40 ? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs] decrypt_raw_data+0x229/0x380 [cifs] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] ? __pfx_cifs_read_iter_from_socket+0x10/0x10 [cifs] smb3_receive_transform+0x837/0xc80 [cifs] ? __pfx_smb3_receive_transform+0x10/0x10 [cifs] ? __pfx___might_resched+0x10/0x10 ? __pfx_smb3_is_transform_hdr+0x10/0x10 [cifs] cifs_demultiplex_thread+0x692/0x1570 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? rcu_is_watching+0x20/0x50 ? rcu_lockdep_current_cpu_online+0x62/0xb0 ? find_held_lock+0x32/0x90 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xd/0xd0 ? trace_irq_enable.constprop.0+0xa8/0xe0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x60 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernelUpgrade kernel-rt-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-rt-64k-debugUpgrade kernel-rt-debug-coreUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-64k-debug-develUpgrade python3-perfUpgrade kernel-64k-debug-coreUpgrade kernel-64k-modules-coreUpgrade kernel-64k-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-coreUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-64kUpgrade kernel-rt-64k-develUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-uki-virtUpgrade rtlaUpgrade kernel-64k-develUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-toolsUpgrade libperfUpgrade kernel-rt-modulesUpgrade kernel-rt-64kUpgrade kernel-rt-64k-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-coreUpgrade kernel-docUpgrade kernel-rt-64k-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-64k-debug-coreUpgrade kernel-modules-coreUpgrade kernel-abi-stablelistsUpgrade kernel-rt-modules-coreUpgrade kernel-debug-devel-matchedUpgrade perfUpgrade kernel-headersUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade rvUpgrade kernel-64k-debug | Jul 4, 2025 | May 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-livepatch-5.10.242-239.961Upgrade kernel-livepatch-5.15.191-132.213Upgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-develUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade perf-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade perf6.12Upgrade kernel-headersUpgrade kernel-libbpf-develUpgrade kernel-debuginfoUpgrade kernel-livepatch-6.1.150-174.273Upgrade kernel-debuginfo-common-x86_64Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.12.25-32.101Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfoUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-libbpfUpgrade kernel-modules-extra-commonUpgrade perfUpgrade kernel-libbpf-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf6.12-debuginfoUpgrade perf-debuginfoUpgrade kernel6.12Upgrade kernel-toolsUpgrade python3-perfUpgrade python3-perf6.12Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade bpftoolUpgrade kernel-modules-extra | Jul 11, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | May 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | May 1, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Jun 17, 2025 | May 1, 2025 |
| Rocky_linux | — | Upgrade kernel-develUpgrade kernel-debugUpgrade kernel-debug-uki-virtUpgrade kernel-modules-extraUpgrade kernel-rt-coreUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade rvUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-modulesUpgrade kernel-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-debug-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade libperfUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernelUpgrade kernel-zfcpdump-modulesUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-uki-virtUpgrade rtlaUpgrade kernel-debuginfo-common-s390xUpgrade libperf-debuginfoUpgrade kernel-devel-matchedUpgrade perf-debuginfo | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade kselftests-kmp-defaultUpgrade kernel-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-macrosUpgrade kernel-rt-develUpgrade kernel-azure-vdsoUpgrade kernel-default-develUpgrade dlm-kmp-64kbUpgrade dlm-kmp-azureUpgrade kernel-default-optionalUpgrade kernel-source-azureUpgrade kernel-64kb-develUpgrade dtb-lgUpgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-azureUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade kernel-default-extraUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade gfs2-kmp-64kbUpgrade dtb-armUpgrade dtb-apmUpgrade kernel-develUpgrade kernel-debug-develUpgrade kernel-kvmsmallUpgrade dtb-amazonUpgrade dtb-amdUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade dtb-appleUpgrade kernel-azure-extraUpgrade kernel-debugUpgrade cluster-md-kmp-defaultUpgrade kernel-obs-qaUpgrade dtb-mediatekUpgrade kernel-devel-rtUpgrade dtb-exynosUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade dtb-hisiliconUpgrade dtb-amlogicUpgrade dtb-freescaleUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-nvidiaUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-default-livepatchUpgrade dtb-rockchipUpgrade kernel-source-vanillaUpgrade dtb-qcomUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-defaultUpgrade kernel-source-rtUpgrade kernel-64kb-extraUpgrade gfs2-kmp-azureUpgrade dtb-broadcomUpgrade reiserfs-kmp-rtUpgrade kernel-debug-vdsoUpgrade dlm-kmp-rtUpgrade dtb-alteraUpgrade kernel-rt-extraUpgrade kernel-default-baseUpgrade dtb-marvellUpgrade dtb-caviumUpgrade kernel-docs-htmlUpgrade gfs2-kmp-defaultUpgrade kernel-azure-develUpgrade dtb-sprdUpgrade dtb-socionextUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-azureUpgrade dtb-allwinnerUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade kernel-rt-vdsoUpgrade kernel-default-base-rebuildUpgrade dtb-renesas | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gkeopUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-azureUpgrade linux-image-azure-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-64-genericUpgrade linux-image-aws-6.8Upgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-generic-64kUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-ibm-classicUpgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-oem-24.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-azure-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.8.0-1031-oemUpgrade linux-image-azure-lts-24.04Upgrade linux-image-aws-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oem-6.8Upgrade linux-image-genericUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1034-azureUpgrade linux-image-6.8.0-64-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-realtime-6.8.1Upgrade linux-image-generic-lpaeUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1029-oracleUpgrade linux-image-6.8.0-1032-awsUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-2026-raspi-realtimeUpgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-virtual-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1031-raspiUpgrade linux-image-realtimeUpgrade linux-image-azure-fde-6.8Upgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1031-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1015-gkeopUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1033-gcpUpgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gcp-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.1-1025-realtimeUpgrade linux-image-6.8.0-1031-nvidiaUpgrade linux-image-6.8.0-1032-aws-64kUpgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.14.0-1007-azureUpgrade linux-image-virtualUpgrade linux-image-kvmUpgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-1031-nvidia-64kUpgrade linux-image-awsUpgrade linux-image-oracle-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1028-gkeUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1029-ibmUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1031-nvidia-lowlatencyUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-fdeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-64-lowlatencyUpgrade linux-image-6.8.0-1029-oracle-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1033-gcp-64kUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.14.0-1007-aws | Jun 26, 2025 | May 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub