In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix the smbd_response slab to allow usercopy
The handling of received data in the smbdirect client code involves using copy_to_iter() to copy data from the smbd_reponse struct's packet trailer to a folioq buffer provided by netfslib that encapsulates a chunk of pagecache.
If, however, CONFIG_HARDENED_USERCOPY=y, this will result in the checks then performed in copy_to_iter() oopsing with something like the following:
CIFS: Attempting to mount //172.31.9.1/test CIFS: VFS: RDMA transport established usercopy: Kernel memory exposure attempt detected from SLUB object 'smbd_response_0000000091e24ea1' (offset 81, size 63)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102! ... RIP: 0010:usercopy_abort+0x6c/0x80 ... Call Trace: <TASK> __check_heap_object+0xe3/0x120 __check_object_size+0x4dc/0x6d0 smbd_recv+0x77f/0xfe0 [cifs] cifs_readv_from_socket+0x276/0x8f0 [cifs] cifs_read_from_socket+0xcd/0x120 [cifs] cifs_demultiplex_thread+0x7e9/0x2d50 [cifs] kthread+0x396/0x830 ret_from_fork+0x2b8/0x3b0 ret_from_fork_asm+0x1a/0x30
The problem is that the smbd_response slab's packet field isn't marked as being permitted for usercopy.
Fix this by passing parameters to kmem_slab_create() to indicate that copy_to_iter() is permitted from the packet region of the smbd_response slab objects, less the header space.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-libbpf-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-libbpfUpgrade kernel6.12-toolsUpgrade kernel-livepatch-6.12.37-61.105Upgrade kernel6.12-headersUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-tools-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-modules-extraUpgrade python3-perf6.12Upgrade perf6.12Upgrade kernel6.12-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12Upgrade perf6.12-debuginfoUpgrade kernel6.12-develUpgrade bpftool6.12-debuginfo | Sep 16, 2025 | Aug 16, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel | Oct 3, 2025 | Aug 16, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernel | Jan 27, 2026 | Aug 16, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debugUpgrade python3-perfUpgrade rvUpgrade kernel-tools-libsUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-toolsUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rtUpgrade kernel-coreUpgrade kernel-rt-kvmUpgrade kernel-debug-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-debug-develUpgrade kernel-rt-modules-coreUpgrade libperf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-kvmUpgrade kernelUpgrade kernel-rt-debug-develUpgrade kernel-devel-matchedUpgrade rtlaUpgrade libperfUpgrade kernel-debuginfo-common-s390xUpgrade perf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-uki-virt | Feb 5, 2026 | Oct 7, 2025 |
| Ubuntu | — | Upgrade linux-image-oracle-64kUpgrade linux-image-azureUpgrade linux-image-gcp-6.14Upgrade linux-image-raspiUpgrade linux-image-6.14.0-34-genericUpgrade linux-image-aws-6.14Upgrade linux-image-azure-nvidiaUpgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1015-awsUpgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1016-raspiUpgrade linux-image-realtime-6.14Upgrade linux-image-6.14.0-1007-azure-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.14.0-1014-oemUpgrade linux-image-6.14.0-1014-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-azure-nvidia-6.14Upgrade linux-image-virtual-6.14Upgrade linux-image-oem-24.04aUpgrade linux-image-genericUpgrade linux-image-oem-24.04bUpgrade linux-image-6.14.0-1018-gcp-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1018-gcpUpgrade linux-image-virtualUpgrade linux-image-awsUpgrade linux-image-6.14.0-1015-oracleUpgrade linux-image-oem-6.14Upgrade linux-image-6.14.0-1014-azureUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-generic-64k-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-aws-64kUpgrade linux-image-gcpUpgrade linux-image-oem-24.04cUpgrade linux-image-6.14.0-1015-oracle-64kUpgrade linux-image-oem-24.04Upgrade linux-image-oracleUpgrade linux-image-6.14.0-1015-aws-64k | Oct 22, 2025 | Aug 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub