In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in decryption with multichannel
After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async decryption"), the channels started reusing AEAD TFM from primary channel to perform synchronous decryption, but that can't done as there could be multiple cifsd threads (one per channel) simultaneously accessing it to perform decryption.
This fixes the following KASAN splat when running fstest generic/249 with 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows Server 2022:
BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110 Read of size 8 at addr ffff8881046c18a0 by task cifsd/986 CPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 print_report+0x156/0x528 ? gf128mul_4k_lle+0xba/0x110 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? gf128mul_4k_lle+0xba/0x110 kasan_report+0xdf/0x1a0 ? gf128mul_4k_lle+0xba/0x110 gf128mul_4k_lle+0xba/0x110 ghash_update+0x189/0x210 shash_ahash_update+0x295/0x370 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_extract_iter_to_sg+0x10/0x10 ? ___kmalloc_large_node+0x10e/0x180 ? __asan_memset+0x23/0x50 crypto_ahash_update+0x3c/0xc0 gcm_hash_assoc_remain_continue+0x93/0xc0 crypt_message+0xe09/0xec0 [cifs] ? __pfx_crypt_message+0x10/0x10 [cifs] ? _raw_spin_unlock+0x23/0x40 ? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs] decrypt_raw_data+0x229/0x380 [cifs] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] ? __pfx_cifs_read_iter_from_socket+0x10/0x10 [cifs] smb3_receive_transform+0x837/0xc80 [cifs] ? __pfx_smb3_receive_transform+0x10/0x10 [cifs] ? __pfx___might_resched+0x10/0x10 ? __pfx_smb3_is_transform_hdr+0x10/0x10 [cifs] cifs_demultiplex_thread+0x692/0x1570 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? rcu_is_watching+0x20/0x50 ? rcu_lockdep_current_cpu_online+0x62/0xb0 ? find_held_lock+0x32/0x90 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xd/0xd0 ? trace_irq_enable.constprop.0+0xa8/0xe0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x60 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade perfUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-modules-coreUpgrade kernel-docUpgrade kernel-64k-debugUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-toolsUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-coreUpgrade rvUpgrade kernel-rt-64kUpgrade kernel-rt-64k-debug-coreUpgrade kernel-modules-coreUpgrade kernel-rtUpgrade kernel-rt-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-rt-64k-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-coreUpgrade libperfUpgrade kernel-rt-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-64k-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-64k-coreUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-debug-develUpgrade kernel-coreUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-modulesUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-64k-develUpgrade kernel-modules-extraUpgrade kernel-rt-develUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernelUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debugUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-libsUpgrade kernel-debug-coreUpgrade kernel-cross-headersUpgrade rtlaUpgrade kernel-64k-modulesUpgrade kernel-debug-develUpgrade kernel-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-debugUpgrade kernel-rt-64k-debug-develUpgrade kernel-64kUpgrade kernel-rt-kvm | Jul 4, 2025 | May 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernelUpgrade perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.191-132.213Upgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.242-239.961Upgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel-libbpfUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel-headersUpgrade kernel-libbpf-develUpgrade kernel-livepatch-6.12.25-32.101Upgrade perf6.12Upgrade kernel-livepatch-6.1.150-174.273Upgrade kernel-libbpf-staticUpgrade kernel6.12-debuginfoUpgrade kernelUpgrade perf6.12-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-libbpf-debuginfoUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade python3-perfUpgrade python3-perf6.12Upgrade perfUpgrade kernel-develUpgrade kernel6.12Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extraUpgrade perf-debuginfo | Jul 11, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | May 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | May 1, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Jun 17, 2025 | May 1, 2025 |
| Rocky_linux | — | Upgrade libperf-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-s390xUpgrade kernel-modulesUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-cross-headersUpgrade libperfUpgrade perf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-kvmUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-develUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-rt-debug-develUpgrade kernel-tools-libs-develUpgrade kernel-headersUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade rtlaUpgrade kernel-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade python3-perf-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-modules-extraUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rtUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libsUpgrade python3-perfUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade rvUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-devel-matched | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade dlm-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-rt_debugUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-azureUpgrade dtb-rockchipUpgrade kernel-default-livepatchUpgrade dtb-nvidiaUpgrade kernel-rt-optionalUpgrade kselftests-kmp-rtUpgrade dtb-alteraUpgrade dtb-marvellUpgrade dtb-caviumUpgrade dtb-socionextUpgrade kernel-docs-htmlUpgrade kernel-default-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-azure-develUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dtb-renesasUpgrade dtb-qcomUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-defaultUpgrade dtb-sprdUpgrade kernel-rtUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-source-rtUpgrade dtb-broadcomUpgrade gfs2-kmp-azureUpgrade kernel-64kb-extraUpgrade kernel-debug-vdsoUpgrade dlm-kmp-rtUpgrade kernel-default-baseUpgrade kernel-rt-extraUpgrade dtb-allwinnerUpgrade kernel-azureUpgrade kernel-macrosUpgrade kernel-develUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade kernel-64kbUpgrade kselftests-kmp-defaultUpgrade dtb-apmUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-develUpgrade dtb-lgUpgrade kernel-docsUpgrade kernel-devel-rtUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-azure-vdsoUpgrade kernel-64kb-develUpgrade dtb-amlogicUpgrade dtb-amdUpgrade kernel-rt-develUpgrade dtb-hisiliconUpgrade dtb-amazonUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-debug-develUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-sourceUpgrade kernel-zfcpdumpUpgrade kernel-obs-qaUpgrade kernel-debugUpgrade kernel-azure-extraUpgrade kernel-64kb-optionalUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade dtb-armUpgrade kernel-default-extraUpgrade kernel-default-develUpgrade dtb-appleUpgrade dlm-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-default-optionalUpgrade dlm-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-symsUpgrade ocfs2-kmp-rt | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-nvidia-64kUpgrade linux-image-ibmUpgrade linux-image-azure-nvidiaUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-aws-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-gkeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1031-oemUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-64-lowlatency-64kUpgrade linux-image-aws-6.8Upgrade linux-image-gcpUpgrade linux-image-6.8.0-64-genericUpgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-nvidiaUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-2026-raspi-realtimeUpgrade linux-image-genericUpgrade linux-image-ibm-classicUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1031-nvidiaUpgrade linux-image-6.8.1-1025-realtimeUpgrade linux-image-6.8.0-1029-oracleUpgrade linux-image-azure-fdeUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.14.0-1007-azureUpgrade linux-image-realtimeUpgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1031-raspiUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1031-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1033-gcpUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1032-aws-64kUpgrade linux-image-ibm-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.8.0-1015-gkeopUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.8.0-1029-oracle-64kUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-64-lowlatencyUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure-fde-6.8Upgrade linux-image-6.8.0-1029-ibmUpgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1028-gkeUpgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-6.8.0-1031-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1034-azureUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-azure-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-1031-nvidia-lowlatencyUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-6.8.0-1033-gcp-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1032-awsUpgrade linux-image-virtual-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-oem-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-oem-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-raspi-realtime-6.8 | Jun 26, 2025 | May 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | May 1, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub