smb: client: fix UAF in decryption with multichannel
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichannel After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async decryption"), the channels started reusing AEAD TFM from primary channel to perform synchronous decryption, but that can't done as there could be multiple cifsd threads (one per channel) simultaneously accessing it to perform decryption. This fixes the following KASAN splat when running fstest generic/249 with 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows Server 2022: BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110 Read of size 8 at addr ffff8881046c18a0 by task cifsd/986 CPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: dump_stack_lvl+0x5d/0x80 print_report+0x156/0x528 ? gf128mul_4k_lle+0xba/0x110 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? gf128mul_4k_lle+0xba/0x110 kasan_report+0xdf/0x1a0 ? gf128mul_4k_lle+0xba/0x110 gf128mul_4k_lle+0xba/0x110 ghash_update+0x189/0x210 shash_ahash_update+0x295/0x370 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_extract_iter_to_sg+0x10/0x10 ? ___kmalloc_large_node+0x10e/0x180 ? __asan_memset+0x23/0x50 crypto_ahash_update+0x3c/0xc0 gcm_hash_assoc_remain_continue+0x93/0xc0 crypt_message+0
CVE-2025-37750
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-37750
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "c8c6af46286a513769650935ff858fc67cf51a6d",
"lessThan": "08160de2a65227e5b64fcb6765cd936ec384ee93",
"versionType": "git"
},
{
"status": "affected",
"version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
"lessThan": "aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15",
"versionType": "git"
},
{
"status": "affected",
"version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
"lessThan": "e859b216d94668bc66330e61be201234f4413d1a",
"versionType": "git"
},
{
"status": "affected",
"version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
"lessThan": "950557922c1298464749c216d8763e97faf5d0a6",
"versionType": "git"
},
{
"status": "affected",
"version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
"lessThan": "9502dd5c7029902f4a425bf959917a5a9e7c0e50",
"versionType": "git"
},
{
"status": "affected",
"version": "8f14a476abba13144df5434871a7225fd29af633",
"versionType": "git"
},
{
"status": "affected",
"version": "ef51c0d544b1518b35364480317ab6d3468f205d",
"versionType": "git"
},
{
"status": "affected",
"version": "bce966530fd5542bbb422cb45ecb775f7a1a6bc3",
"versionType": "git"
},
{
"status": "affected",
"version": "0809fb86ad13b29e1d6d491364fc7ea4fb545995",
"versionType": "git"
},
{
"status": "affected",
"version": "538c26d9bf70c90edc460d18c81008a4e555925a",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.237",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.181",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.128",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.11.4",
"lessThan": "6.12",
"versionType": "semver"
}
],
"programFiles": [
"fs/smb/client/cifsencrypt.c",
"fs/smb/client/smb2ops.c",
"fs/smb/client/smb2pdu.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.24",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.13.12",
"versionType": "semver",
"lessThanOrEqual": "6.13.*"
},
{
"status": "unaffected",
"version": "6.14.3",
"versionType": "semver",
"lessThanOrEqual": "6.14.*"
},
{
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/smb/client/cifsencrypt.c",
"fs/smb/client/smb2ops.c",
"fs/smb/client/smb2pdu.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-37750
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #45971 · Revision 1
- Added to Heist Feed
- Publisher date