smb: client: Fix use-after-free in cifs_fill_dirent
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warning. ================================================================== BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs] Read of size 4 at addr ffff8880099b819c by task a.out/342975 CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xce/0x640 kasan_report+0xb8/0xf0 cifs_fill_dirent+0xb03/0xb60 [cifs] cifs_readdir+0x12cb/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f996f64b9f9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8 RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88 R13: 0000000000000000 R14: 00007ffc8c
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.238, 5.15.185, 5.4.294, 6.1.141, 6.12.31, 6.14.9, 6.6.93
- CVEs
- CVE-2025-38051
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:12 UTC · Revision 1
Source evidence
smb: client: Fix use-after-free in cifs_fill_dirent
core-osv · Original sourcePublished 18 Jun 2025, 09:33 UTC
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warning. ================================================================== BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs] Read of size 4 at addr ffff8880099b819c by task a.out/342975 CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xce/0x640 kasan_report+0xb8/0xf0 cifs_fill_dirent+0xb03/0xb60 [cifs] cifs_readdir+0x12cb/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f996f64b9f9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8 RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88 R13: 0000000000000000 R14: 00007ffc8c
osv:CVE-2025-38051
Kernel
Fixed versions: 5.4.294, 5.10.238, 5.15.185, 6.1.141, 6.6.93, 6.12.31, 6.14.9
Complete source record
{
"id": "93e15caff733d8b17d154f4afb5e98249396fd85afcf239517c8cad08365c0ba",
"url": "https://osv.dev/vulnerability/CVE-2025-38051",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "smb: client: Fix use-after-free in cifs_fill_dirent",
"summary": "In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warning. ================================================================== BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs] Read of size 4 at addr ffff8880099b819c by task a.out/342975 CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xce/0x640 kasan_report+0xb8/0xf0 cifs_fill_dirent+0xb03/0xb60 [cifs] cifs_readdir+0x12cb/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f996f64b9f9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8 RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88 R13: 0000000000000000 R14: 00007ffc8c",
"evidence": "osv:CVE-2025-38051",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.294",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.238",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.185",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.141",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.93",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.31",
"evidence": "/affected/1/ranges"
},
{
"value": "6.14.9",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2025-38051",
"aliases": [
"CVE-2025-38051"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a364bc0b37f14ffd66c1f982af42990a9d77fa43"
},
{
"fixed": "aee067e88d61eb72e966f094e4749c6b14e7008f"
},
{
"fixed": "a24c2f05ac3c5b0aaa539d9d913826d2643dfd0e"
},
{
"fixed": "1b197931fbc821bc7e9e91bf619400db563e3338"
},
{
"fixed": "c8623231e0edfcccb7cc6add0288fa0f0594282f"
},
{
"fixed": "73cadde98f67f76c5eba00ac0b72c453383cec8b"
},
{
"fixed": "9bea368648ac46f8593a780760362e40291d22a9"
},
{
"fixed": "9c9aafbacc183598f064902365e107b5e856531f"
},
{
"fixed": "a7a8fe56e932a36f43e031b398aef92341bf5ea0"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "2.6.27.4"
},
{
"fixed": "2.6.28"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "0f3da51e7046e2eb28992ba65c22d058f571356c"
}
]
}
],
"versions": [
"v2.6.27.62",
"v2.6.27.61",
"v2.6.27.60",
"v2.6.27.59",
"v2.6.27.58",
"v2.6.27.57",
"v2.6.27.56",
"v2.6.27.55",
"v2.6.27.54",
"v2.6.27.53",
"v2.6.27.52",
"v2.6.27.51",
"v2.6.27.50",
"v2.6.27.49",
"v2.6.27.48",
"v2.6.27.47",
"v2.6.27.46",
"v2.6.27.45",
"v2.6.27.44",
"v2.6.27.43",
"v2.6.27.42",
"v2.6.27.41",
"v2.6.27.40",
"v2.6.27.39",
"v2.6.27.38",
"v2.6.27.37",
"v2.6.27.36",
"v2.6.27.35",
"v2.6.27.34",
"v2.6.27.33",
"v2.6.27.32",
"v2.6.27.31",
"v2.6.27.30",
"v2.6.27.29",
"v2.6.27.28",
"v2.6.27.27",
"v2.6.27.26",
"v2.6.27.25",
"v2.6.27.24",
"v2.6.27.23",
"v2.6.27.22",
"v2.6.27.21",
"v2.6.27.20",
"v2.6.27.19",
"v2.6.27.18",
"v2.6.27.17",
"v2.6.27.16",
"v2.6.27.15",
"v2.6.27.14",
"v2.6.27.13",
"v2.6.27.12",
"v2.6.27.11",
"v2.6.27.10",
"v2.6.27.9",
"v2.6.27.8",
"v2.6.27.7",
"v2.6.27.6",
"v2.6.27.5",
"v2.6.27.4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38051.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.28"
},
{
"fixed": "5.4.294"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.238"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.185"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.141"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.93"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.31"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.14.9"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38051.json"
}
}
],
"modified": "2026-10-28T02:30:27.409976934Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/1b197931fbc821bc7e9e91bf619400db563e3338",
"https://git.kernel.org/stable/c/73cadde98f67f76c5eba00ac0b72c453383cec8b",
"https://git.kernel.org/stable/c/9bea368648ac46f8593a780760362e40291d22a9",
"https://git.kernel.org/stable/c/9c9aafbacc183598f064902365e107b5e856531f",
"https://git.kernel.org/stable/c/a24c2f05ac3c5b0aaa539d9d913826d2643dfd0e",
"https://git.kernel.org/stable/c/a7a8fe56e932a36f43e031b398aef92341bf5ea0",
"https://git.kernel.org/stable/c/aee067e88d61eb72e966f094e4749c6b14e7008f",
"https://git.kernel.org/stable/c/c8623231e0edfcccb7cc6add0288fa0f0594282f",
"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38051.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-38051",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38051.json"
}
},
"related_cves": [
{
"value": "CVE-2025-38051",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493665,
"published_at": "2025-06-18T09:33:32.805+00:00"
}