In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in decryption with multichannel
After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async decryption"), the channels started reusing AEAD TFM from primary channel to perform synchronous decryption, but that can't done as there could be multiple cifsd threads (one per channel) simultaneously accessing it to perform decryption.
This fixes the following KASAN splat when running fstest generic/249 with 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows Server 2022:
BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110 Read of size 8 at addr ffff8881046c18a0 by task cifsd/986 CPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 print_report+0x156/0x528 ? gf128mul_4k_lle+0xba/0x110 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? gf128mul_4k_lle+0xba/0x110 kasan_report+0xdf/0x1a0 ? gf128mul_4k_lle+0xba/0x110 gf128mul_4k_lle+0xba/0x110 ghash_update+0x189/0x210 shash_ahash_update+0x295/0x370 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_extract_iter_to_sg+0x10/0x10 ? ___kmalloc_large_node+0x10e/0x180 ? __asan_memset+0x23/0x50 crypto_ahash_update+0x3c/0xc0 gcm_hash_assoc_remain_continue+0x93/0xc0 crypt_message+0xe09/0xec0 [cifs] ? __pfx_crypt_message+0x10/0x10 [cifs] ? _raw_spin_unlock+0x23/0x40 ? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs] decrypt_raw_data+0x229/0x380 [cifs] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] ? __pfx_cifs_read_iter_from_socket+0x10/0x10 [cifs] smb3_receive_transform+0x837/0xc80 [cifs] ? __pfx_smb3_receive_transform+0x10/0x10 [cifs] ? __pfx___might_resched+0x10/0x10 ? __pfx_smb3_is_transform_hdr+0x10/0x10 [cifs] cifs_demultiplex_thread+0x692/0x1570 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? rcu_is_watching+0x20/0x50 ? rcu_lockdep_current_cpu_online+0x62/0xb0 ? find_held_lock+0x32/0x90 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xd/0xd0 ? trace_irq_enable.constprop.0+0xa8/0xe0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x60 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-rt-64kUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-devel-matchedUpgrade kernel-rtUpgrade kernel-64k-debugUpgrade kernel-rt-64k-debug-modulesUpgrade perfUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-rt-64k-debug-coreUpgrade kernel-docUpgrade kernel-zfcpdump-modulesUpgrade kernel-modules-coreUpgrade kernel-toolsUpgrade kernel-64k-coreUpgrade libperfUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64k-modulesUpgrade rvUpgrade kernel-64k-debug-modules-extraUpgrade kernel-headersUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-rt-64k-debug-develUpgrade kernel-modulesUpgrade kernel-64k-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-rt-coreUpgrade kernel-debug-uki-virtUpgrade kernel-64k-develUpgrade kernel-rt-64k-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-64kUpgrade python3-perfUpgrade kernel-rt-64k-develUpgrade kernelUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-64k-debugUpgrade kernel-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-libsUpgrade rtlaUpgrade kernel-debugUpgrade kernel-cross-headersUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade kernel-64k-debug-develUpgrade kernel-debug-coreUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-debug-modulesUpgrade kernel-debug-devel | Jul 4, 2025 | May 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.242-239.961Upgrade python-perfUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-5.15.191-132.213Upgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-aarch64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade perf6.12Upgrade kernelUpgrade kernel-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.12-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-6.12.25-32.101Upgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.1.150-174.273Upgrade kernel-libbpfUpgrade kernel-toolsUpgrade kernel-modules-extra-commonUpgrade kernel-develUpgrade python3-perf6.12Upgrade python3-perfUpgrade perfUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-aarch64Upgrade kernel6.12Upgrade perf-debuginfoUpgrade perf6.12-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-debuginfoUpgrade python3-perf-debuginfo | Jul 11, 2025 | May 1, 2025 |
| Debian | — | Upgrade linuxNo solution exists | May 15, 2025 | May 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | May 1, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernel | Jun 17, 2025 | May 1, 2025 |
| Rocky_linux | — | Upgrade rvUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-debugUpgrade kernel-debug-uki-virtUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perf-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-kvmUpgrade perfUpgrade python3-perfUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libsUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rtUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debuginfoUpgrade kernel-modulesUpgrade kernelUpgrade libperf-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-cross-headersUpgrade kernel-zfcpdumpUpgrade kernel-modules-coreUpgrade libperfUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-extraUpgrade kernel-debug-debuginfoUpgrade rtlaUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-develUpgrade kernel-uki-virtUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-coreUpgrade perf-debuginfo | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade dlm-kmp-64kbUpgrade kernel-source-azureUpgrade dlm-kmp-azureUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade kernel-default-develUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmallUpgrade kernel-develUpgrade dtb-xilinxUpgrade dtb-apmUpgrade kernel-64kbUpgrade kernel-devel-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-symsUpgrade dtb-mediatekUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade dtb-hisiliconUpgrade kselftests-kmp-defaultUpgrade gfs2-kmp-rtUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-macrosUpgrade kernel-rt-develUpgrade kernel-obs-qaUpgrade kernel-sourceUpgrade kernel-64kb-optionalUpgrade kernel-azure-extraUpgrade kernel-debugUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dtb-lgUpgrade kernel-devel-rtUpgrade kernel-docsUpgrade dtb-freescaleUpgrade dtb-amdUpgrade dtb-amlogicUpgrade kernel-zfcpdumpUpgrade dtb-exynosUpgrade gfs2-kmp-64kbUpgrade dtb-armUpgrade kernel-syms-rtUpgrade cluster-md-kmp-defaultUpgrade dtb-amazonUpgrade kernel-debug-develUpgrade dtb-appleUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade dlm-kmp-rtUpgrade dtb-broadcomUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-rtUpgrade dtb-qcomUpgrade kernel-default-livepatch-develUpgrade kernel-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-source-rtUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-sprdUpgrade dtb-socionextUpgrade dtb-renesasUpgrade kernel-docs-htmlUpgrade kernel-default-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-azure-develUpgrade kernel-source-vanillaUpgrade kernel-rt_debugUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-azureUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade kernel-azure-optionalUpgrade kernel-azureUpgrade dtb-allwinnerUpgrade reiserfs-kmp-64kbUpgrade dtb-alteraUpgrade kernel-rt-extraUpgrade kernel-default-livepatchUpgrade dtb-nvidiaUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-defaultUpgrade kernel-default-baseUpgrade dtb-marvellUpgrade dtb-caviumUpgrade dtb-rockchipUpgrade gfs2-kmp-azure | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-64-lowlatency-64kUpgrade linux-image-aws-6.8Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-gkeUpgrade linux-image-6.8.0-1029-oracleUpgrade linux-image-6.8.0-1032-awsUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1034-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-realtime-6.8.1Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-aws-64kUpgrade linux-image-gcpUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-2026-raspi-realtimeUpgrade linux-image-azure-6.8Upgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1031-oemUpgrade linux-image-nvidiaUpgrade linux-image-virtual-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-azureUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gkeopUpgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-oem-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-raspi-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-gke-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-64-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-genericUpgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-ibm-classicUpgrade linux-image-oem-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1029-oracle-64kUpgrade linux-image-kvmUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-virtualUpgrade linux-image-ibm-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-1031-nvidia-64kUpgrade linux-image-6.8.0-1028-gkeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-64-lowlatencyUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.14.0-1007-awsUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1033-gcpUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-azure-fde-6.8Upgrade linux-image-6.8.0-1029-ibmUpgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1033-gcp-64kUpgrade linux-image-6.8.0-1031-nvidia-lowlatencyUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1031-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.8.0-1032-aws-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.1-1025-realtimeUpgrade linux-image-6.8.0-1031-raspiUpgrade linux-image-6.8.0-1031-nvidiaUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.8.0-1015-gkeopUpgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-64k-6.8 | Jun 26, 2025 | May 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub