Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-37750— smb: client: fix UAF in decryption with multichannel

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于smb客户端在多通道解密中存在释放后重用问题。

CVSS 9.8 · Critical EPSS 0.38% · P30

Possible ATT&CK Techniques 1 AI

T1552.005 · Cloud Instance Metadata API

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux b0abcd65ec545701b8793e12bc27dc98042b151a< aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15 affected
b0abcd65ec545701b8793e12bc27dc98042b151a< e859b216d94668bc66330e61be201234f4413d1a affected
b0abcd65ec545701b8793e12bc27dc98042b151a< 950557922c1298464749c216d8763e97faf5d0a6 affected
b0abcd65ec545701b8793e12bc27dc98042b151a< 9502dd5c7029902f4a425bf959917a5a9e7c0e50 affected
8f14a476abba13144df5434871a7225fd29af633 affected
ef51c0d544b1518b35364480317ab6d3468f205d affected
bce966530fd5542bbb422cb45ecb775f7a1a6bc3 affected
0809fb86ad13b29e1d6d491364fc7ea4fb545995 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-37750

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
smb: client: fix UAF in decryption with multichannel
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichannel After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async decryption"), the channels started reusing AEAD TFM from primary channel to perform synchronous decryption, but that can't done as there could be multiple cifsd threads (one per channel) simultaneously accessing it to perform decryption. This fixes the following KASAN splat when running fstest generic/249 with 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows Server 2022: BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110 Read of size 8 at addr ffff8881046c18a0 by task cifsd/986 CPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 print_report+0x156/0x528 ? gf128mul_4k_lle+0xba/0x110 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? gf128mul_4k_lle+0xba/0x110 kasan_report+0xdf/0x1a0 ? gf128mul_4k_lle+0xba/0x110 gf128mul_4k_lle+0xba/0x110 ghash_update+0x189/0x210 shash_ahash_update+0x295/0x370 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_shash_ahash_update+0x10/0x10 ? __pfx_extract_iter_to_sg+0x10/0x10 ? ___kmalloc_large_node+0x10e/0x180 ? __asan_memset+0x23/0x50 crypto_ahash_update+0x3c/0xc0 gcm_hash_assoc_remain_continue+0x93/0xc0 crypt_message+0xe09/0xec0 [cifs] ? __pfx_crypt_message+0x10/0x10 [cifs] ? _raw_spin_unlock+0x23/0x40 ? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs] decrypt_raw_data+0x229/0x380 [cifs] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] ? __pfx_cifs_read_iter_from_socket+0x10/0x10 [cifs] smb3_receive_transform+0x837/0xc80 [cifs] ? __pfx_smb3_receive_transform+0x10/0x10 [cifs] ? __pfx___might_resched+0x10/0x10 ? __pfx_smb3_is_transform_hdr+0x10/0x10 [cifs] cifs_demultiplex_thread+0x692/0x1570 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? rcu_is_watching+0x20/0x50 ? rcu_lockdep_current_cpu_online+0x62/0xb0 ? find_held_lock+0x32/0x90 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xd/0xd0 ? trace_irq_enable.constprop.0+0xa8/0xe0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x60 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于smb客户端在多通道解密中存在释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b0abcd65ec545701b8793e12bc27dc98042b151a ~ aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15 -
Linux Linux 6.12 -

II. Public POCs for CVE-2025-37750

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-37750

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-37750 (4)

Same Patch Batch · Linux · 2025-05-01 · 245 CVEs total

CVE-2022-49770 9.8 CRITICAL ceph: avoid putting the realm twice when decoding snaps fails
CVE-2025-37778 9.8 CRITICAL ksmbd: Fix dangling pointer in krb_authenticate
CVE-2022-49931 8.8 HIGH IB/hfi1: Correctly move list in sc_disable()
CVE-2025-37790 8.8 HIGH net: mctp: Set SOCK_RCU_FREE
CVE-2025-37777 8.8 HIGH ksmbd: fix use-after-free in __smb2_lease_break_noti()
CVE-2025-37776 8.8 HIGH ksmbd: fix use-after-free in smb_break_all_levII_oplock()
CVE-2022-49910 8.8 HIGH Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
CVE-2025-23159 8.4 HIGH media: venus: hfi: add a check to handle OOB in sfr region
CVE-2022-49886 8.4 HIGH x86/tdx: Panic on bad configs that #VE on "private" memory access
CVE-2025-37749 8.2 HIGH net: ppp: Add bound checking for skb data on ppp_sync_txmung
CVE-2025-37752 7.8 HIGH net_sched: sch_sfq: move the limit validation
CVE-2025-37761 7.8 HIGH drm/xe: Fix an out-of-bounds shift when invalidating TLB
CVE-2022-49763 7.8 HIGH ntfs: fix use-after-free in ntfs_attr_find()
CVE-2025-37791 7.8 HIGH ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
CVE-2025-37789 7.8 HIGH net: openvswitch: fix nested key length validation in the set() action
CVE-2025-37774 7.8 HIGH slab: ensure slab->obj_exts is clear in a newly allocated slab page
CVE-2025-37763 7.8 HIGH drm/imagination: take paired job reference
CVE-2025-37765 7.8 HIGH drm/nouveau: prime: fix ttm_bo_delayed_delete oops
CVE-2022-49804 7.8 HIGH s390: avoid using global register for current_stack_pointer
CVE-2025-37756 7.8 HIGH net: tls: explicitly disallow disconnect

Showing top 20 of 245 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-37750

No comments yet

Leave a comment