Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-21673— smb: client: fix double free of TCP_Server_Info::hostname

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在资源管理错误漏洞，该漏洞源于cifs_put_tcp_session函数在关闭服务器时，cifsd线程可能仍在尝试重新连接DFS目标，导致server->hostname被重复释放，引发空指针引用。

CVSS 9.8 · Critical EPSS 0.41% · P34

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 7be3248f313930ff3d3436d4e9ddbe9fccc1f541< 1ea68070338518a1d31ce71e6abfe1b30001b27a affected
7be3248f313930ff3d3436d4e9ddbe9fccc1f541< a2be5f2ba34d0c6d5ef2624b24e3d852561fcd6a affected
7be3248f313930ff3d3436d4e9ddbe9fccc1f541< fa2f9906a7b333ba757a7dbae0713d8a5396186e affected
49f933bb3016269dc50074eac5f6033d127644f1 affected
1c35a216ef77db708178ca225d796271f2f60a7a affected
5.14.19< 5.15 affected
5.15.3< 5.16 affected
5.16 affected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21673

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
smb: client: fix double free of TCP_Server_Info::hostname
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double free of TCP_Server_Info::hostname When shutting down the server in cifs_put_tcp_session(), cifsd thread might be reconnecting to multiple DFS targets before it realizes it should exit the loop, so @server->hostname can't be freed as long as cifsd thread isn't done. Otherwise the following can happen: RIP: 0010:__slab_free+0x223/0x3c0 Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f> 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80 RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246 RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068 RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400 RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000 R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500 R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068 FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000) 000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4: PKRU: 55555554 Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? __reconnect_target_unlocked+0x3e/0x160 [cifs] ? __die_body.cold+0x8/0xd ? die+0x2b/0x50 ? do_trap+0xce/0x120 ? __slab_free+0x223/0x3c0 ? do_error_trap+0x65/0x80 ? __slab_free+0x223/0x3c0 ? exc_invalid_op+0x4e/0x70 ? __slab_free+0x223/0x3c0 ? asm_exc_invalid_op+0x16/0x20 ? __slab_free+0x223/0x3c0 ? extract_hostname+0x5c/0xa0 [cifs] ? extract_hostname+0x5c/0xa0 [cifs] ? __kmalloc+0x4b/0x140 __reconnect_target_unlocked+0x3e/0x160 [cifs] reconnect_dfs_server+0x145/0x430 [cifs] cifs_handle_standard+0x1ad/0x1d0 [cifs] cifs_demultiplex_thread+0x592/0x730 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0xdd/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 </TASK>
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在资源管理错误漏洞，该漏洞源于cifs_put_tcp_session函数在关闭服务器时，cifsd线程可能仍在尝试重新连接DFS目标，导致server->hostname被重复释放，引发空指针引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7be3248f313930ff3d3436d4e9ddbe9fccc1f541 ~ 1ea68070338518a1d31ce71e6abfe1b30001b27a -
Linux Linux 5.16 -

II. Public POCs for CVE-2025-21673

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21673

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21673 (3)

Same Patch Batch · Linux · 2025-01-31 · 20 CVEs total

CVE-2025-21680 7.8 HIGH pktgen: Avoid out-of-bounds access in get_imix_entries
CVE-2025-21678 7.8 HIGH gtp: Destroy device along with udp socket's netns dismantle.
CVE-2025-21677 7.8 HIGH pfcp: Destroy device along with udp socket's netns dismantle.
CVE-2025-21669 7.8 HIGH vsock/virtio: discard packets if the transport changes
CVE-2025-21676 7.5 HIGH net: fec: handle page_pool_dev_alloc_pages error
CVE-2025-21682 7.3 HIGH eth: bnxt: always recalculate features after XDP clearing, fix null-deref
CVE-2024-57948 mac802154: check local interfaces before deleting sdata list
CVE-2025-21683 bpf: Fix bpf_sk_select_reuseport() memory leak
CVE-2025-21665 filemap: avoid truncating 64-bit offset to 32 bits
CVE-2025-21666 vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
CVE-2025-21667 iomap: avoid avoid truncating 64-bit offset to 32 bits
CVE-2025-21668 pmdomain: imx8mp-blk-ctrl: add missing loop break condition
CVE-2025-21670 vsock/bpf: return early if transport is not assigned
CVE-2025-21671 zram: fix potential UAF of zram table
CVE-2025-21672 afs: Fix merge preference rule failure condition
CVE-2025-21674 net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel
CVE-2025-21675 net/mlx5: Clear port select structure when fail to create
CVE-2025-21679 btrfs: add the missing error handling inside get_canonical_dev_path
CVE-2025-21681 openvswitch: fix lockup on tx to unregistering netdev with carrier

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21673

No comments yet

Leave a comment