{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2025-37750", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-37750", "idYear": 2025, "status": "PUBLISHED", "publishedAt": "2025-05-01T12:55:55.988Z", "updatedAt": "2026-10-21T12:36:26.033Z", "importedAt": "2026-10-24T01:57:34.152Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "smb: client: fix UAF in decryption with multichannel", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF in decryption with multichannel\n\nAfter commit f7025d861694 (\"smb: client: allocate crypto only for\nprimary server\") and commit b0abcd65ec54 (\"smb: client: fix UAF in\nasync decryption\"), the channels started reusing AEAD TFM from primary\nchannel to perform synchronous decryption, but that can't done as\nthere could be multiple cifsd threads (one per channel) simultaneously\naccessing it to perform decryption.\n\nThis fixes the following KASAN splat when running fstest generic/249\nwith 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows\nServer 2022:\n\nBUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110\nRead of size 8 at addr ffff8881046c18a0 by task cifsd/986\nCPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1\nPREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41\n04/01/2014\nCall Trace:\n \n dump_stack_lvl+0x5d/0x80\n print_report+0x156/0x528\n ? gf128mul_4k_lle+0xba/0x110\n ? __virt_addr_valid+0x145/0x300\n ? __phys_addr+0x46/0x90\n ? gf128mul_4k_lle+0xba/0x110\n kasan_report+0xdf/0x1a0\n ? gf128mul_4k_lle+0xba/0x110\n gf128mul_4k_lle+0xba/0x110\n ghash_update+0x189/0x210\n shash_ahash_update+0x295/0x370\n ? __pfx_shash_ahash_update+0x10/0x10\n ? __pfx_shash_ahash_update+0x10/0x10\n ? __pfx_extract_iter_to_sg+0x10/0x10\n ? ___kmalloc_large_node+0x10e/0x180\n ? __asan_memset+0x23/0x50\n crypto_ahash_update+0x3c/0xc0\n gcm_hash_assoc_remain_continue+0x93/0xc0\n crypt_message+0xe09/0xec0 [cifs]\n ? __pfx_crypt_message+0x10/0x10 [cifs]\n ? _raw_spin_unlock+0x23/0x40\n ? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs]\n decrypt_raw_data+0x229/0x380 [cifs]\n ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]\n ? __pfx_cifs_read_iter_from_socket+0x10/0x10 [cifs]\n smb3_receive_transform+0x837/0xc80 [cifs]\n ? __pfx_smb3_receive_transform+0x10/0x10 [cifs]\n ? __pfx___might_resched+0x10/0x10\n ? __pfx_smb3_is_transform_hdr+0x10/0x10 [cifs]\n cifs_demultiplex_thread+0x692/0x1570 [cifs]\n ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]\n ? rcu_is_watching+0x20/0x50\n ? rcu_lockdep_current_cpu_online+0x62/0xb0\n ? find_held_lock+0x32/0x90\n ? kvm_sched_clock_read+0x11/0x20\n ? local_clock_noinstr+0xd/0xd0\n ? trace_irq_enable.constprop.0+0xa8/0xe0\n ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]\n kthread+0x1fe/0x380\n ? kthread+0x10f/0x380\n ? __pfx_kthread+0x10/0x10\n ? local_clock_noinstr+0xd/0xd0\n ? ret_from_fork+0x1b/0x60\n ? local_clock+0x15/0x30\n ? lock_release+0x29b/0x390\n ? rcu_is_watching+0x20/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x31/0x60\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n ", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "c8c6af46286a513769650935ff858fc67cf51a6d", "status": "affected", "versionType": "git", "lessThan": "08160de2a65227e5b64fcb6765cd936ec384ee93" }, { "version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "status": "affected", "versionType": "git", "lessThan": "aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15" }, { "version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "status": "affected", "versionType": "git", "lessThan": "e859b216d94668bc66330e61be201234f4413d1a" }, { "version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "status": "affected", "versionType": "git", "lessThan": "950557922c1298464749c216d8763e97faf5d0a6" }, { "version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "status": "affected", "versionType": "git", "lessThan": "9502dd5c7029902f4a425bf959917a5a9e7c0e50" }, { "version": "8f14a476abba13144df5434871a7225fd29af633", "status": "affected", "versionType": "git" }, { "version": "ef51c0d544b1518b35364480317ab6d3468f205d", "status": "affected", "versionType": "git" }, { "version": "bce966530fd5542bbb422cb45ecb775f7a1a6bc3", "status": "affected", "versionType": "git" }, { "version": "0809fb86ad13b29e1d6d491364fc7ea4fb545995", "status": "affected", "versionType": "git" }, { "version": "538c26d9bf70c90edc460d18c81008a4e555925a", "status": "affected", "versionType": "git" }, { "version": "5.10.237", "status": "affected", "versionType": "semver", "lessThan": "5.11" }, { "version": "5.15.181", "status": "affected", "versionType": "semver", "lessThan": "5.16" }, { "version": "6.1.128", "status": "affected", "versionType": "semver", "lessThan": "6.2" }, { "version": "6.11.4", "status": "affected", "versionType": "semver", "lessThan": "6.12" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.12" }, { "version": "6.12.24", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.13.12", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.13.*" }, { "version": "6.14.3", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.14.*" }, { "version": "6.15", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }