CVE-2025-38488 (GCVE-0-2025-38488)

Vulnerability from cvelistv5 – Published: 2025-07-28 11:21 – Updated: 2026-08-05 12:02
VLAI
Title
smb: client: fix use-after-free in crypt_message when using async crypto
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are synchronous. However, when hardware crypto accelerators are used, this can cause use-after-free crashes: crypt_message() // Allocate the creq buffer containing the req creq = smb2_get_aead_req(..., &req); // Async encryption returns -EINPROGRESS immediately rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); // Free creq while async operation is still in progress kvfree_sensitive(creq, ...); Hardware crypto modules often implement async AEAD operations for performance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS, the operation completes asynchronously. Without crypto_wait_req(), the function immediately frees the request buffer, leading to crashes when the driver later accesses the freed memory. This results in a use-after-free condition when the hardware crypto driver later accesses the freed request structure, leading to kernel crashes with NULL pointer dereferences. The issue occurs because crypto_alloc_aead() with mask=0 doesn't guarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in the mask, async implementations can be selected. Fix by restoring the async crypto handling: - DECLARE_CRYPTO_WAIT(wait) for completion tracking - aead_request_set_callback() for async completion notification - crypto_wait_req() to wait for operation completion This ensures the request buffer isn't freed until the crypto operation completes, whether synchronous or asynchronous, while preserving the CVE-2024-50047 fix.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8f14a476abba13144df5434871a7225fd29af633 , < 5d047b12f86cc3b9fde1171c02d9bccf4dba0632 (git)
Affected: ef51c0d544b1518b35364480317ab6d3468f205d , < 6550b2bef095d0dd2d2c8390d2ea4c3837028833 (git)
Affected: bce966530fd5542bbb422cb45ecb775f7a1a6bc3 , < 9a1d3e8d40f151c2d5a5f40c410e6e433f62f438 (git)
Affected: 0809fb86ad13b29e1d6d491364fc7ea4fb545995 , < 15a0a5de49507062bc3be4014a403d8cea5533de (git)
Affected: b0abcd65ec545701b8793e12bc27dc98042b151a , < 2a76bc2b24ed889a689fb1c9015307bf16aafb5b (git)
Affected: b0abcd65ec545701b8793e12bc27dc98042b151a , < 8ac90f6824fc44d2e55a82503ddfc95defb19ae0 (git)
Affected: b0abcd65ec545701b8793e12bc27dc98042b151a , < b220bed63330c0e1733dc06ea8e75d5b9962b6b6 (git)
Affected: 538c26d9bf70c90edc460d18c81008a4e555925a (git)
Affected: 5.10.237 , < 5.10.241 (semver)
Affected: 5.15.181 , < 5.15.190 (semver)
Affected: 6.1.128 , < 6.1.147 (semver)
Affected: 6.6.57 , < 6.6.100 (semver)
Affected: 6.11.4 , < 6.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.147 , ≤ 6.1.* (semver)
Unaffected: 6.6.100 , ≤ 6.6.* (semver)
Unaffected: 6.12.40 , ≤ 6.12.* (semver)
Unaffected: 6.15.8 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:58.858Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5d047b12f86cc3b9fde1171c02d9bccf4dba0632",
              "status": "affected",
              "version": "8f14a476abba13144df5434871a7225fd29af633",
              "versionType": "git"
            },
            {
              "lessThan": "6550b2bef095d0dd2d2c8390d2ea4c3837028833",
              "status": "affected",
              "version": "ef51c0d544b1518b35364480317ab6d3468f205d",
              "versionType": "git"
            },
            {
              "lessThan": "9a1d3e8d40f151c2d5a5f40c410e6e433f62f438",
              "status": "affected",
              "version": "bce966530fd5542bbb422cb45ecb775f7a1a6bc3",
              "versionType": "git"
            },
            {
              "lessThan": "15a0a5de49507062bc3be4014a403d8cea5533de",
              "status": "affected",
              "version": "0809fb86ad13b29e1d6d491364fc7ea4fb545995",
              "versionType": "git"
            },
            {
              "lessThan": "2a76bc2b24ed889a689fb1c9015307bf16aafb5b",
              "status": "affected",
              "version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
              "versionType": "git"
            },
            {
              "lessThan": "8ac90f6824fc44d2e55a82503ddfc95defb19ae0",
              "status": "affected",
              "version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
              "versionType": "git"
            },
            {
              "lessThan": "b220bed63330c0e1733dc06ea8e75d5b9962b6b6",
              "status": "affected",
              "version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "538c26d9bf70c90edc460d18c81008a4e555925a",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.241",
              "status": "affected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.190",
              "status": "affected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.147",
              "status": "affected",
              "version": "6.1.128",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.100",
              "status": "affected",
              "version": "6.6.57",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "5.10.237",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.15.181",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "6.1.128",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "6.6.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in crypt_message when using async crypto\n\nThe CVE-2024-50047 fix removed asynchronous crypto handling from\ncrypt_message(), assuming all crypto operations are synchronous.\nHowever, when hardware crypto accelerators are used, this can cause\nuse-after-free crashes:\n\n  crypt_message()\n    // Allocate the creq buffer containing the req\n    creq = smb2_get_aead_req(..., \u0026req);\n\n    // Async encryption returns -EINPROGRESS immediately\n    rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);\n\n    // Free creq while async operation is still in progress\n    kvfree_sensitive(creq, ...);\n\nHardware crypto modules often implement async AEAD operations for\nperformance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,\nthe operation completes asynchronously. Without crypto_wait_req(),\nthe function immediately frees the request buffer, leading to crashes\nwhen the driver later accesses the freed memory.\n\nThis results in a use-after-free condition when the hardware crypto\ndriver later accesses the freed request structure, leading to kernel\ncrashes with NULL pointer dereferences.\n\nThe issue occurs because crypto_alloc_aead() with mask=0 doesn\u0027t\nguarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in\nthe mask, async implementations can be selected.\n\nFix by restoring the async crypto handling:\n- DECLARE_CRYPTO_WAIT(wait) for completion tracking\n- aead_request_set_callback() for async completion notification\n- crypto_wait_req() to wait for operation completion\n\nThis ensures the request buffer isn\u0027t freed until the crypto operation\ncompletes, whether synchronous or asynchronous, while preserving the\nCVE-2024-50047 fix."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The decrypt path of crypt_message() processes SMB3 transform PDUs received from the remote server (smb3_receive_transform \u2192 receive_encrypted_read/standard \u2192 decrypt_raw_data), and the server itself dictates whether encryption is used via SMB2_SESSION_FLAG_ENCRYPT_DATA/SHI1005_FLAGS_ENCRYPT_DATA, so a remote SMB peer drives the vulnerable code over TCP/445.\nAC:L - There is no race the attacker must win: on any target whose crypto API binds gcm(aes)/ccm(aes) to an async hardware accelerator (CAAM, CCP, Chelsio, HiSilicon, Tegra, STM32 and ~24 other in-tree drivers, ubiquitous on embedded and enterprise hardware), every single encrypted SMB message frees the in-flight request buffer deterministically, and the attacker further controls message size and rate to time heap reuse.\nPR:N - The attacker is the remote SMB server (or an attacker who has compromised it) and holds no privileges whatsoever on the vulnerable client; it can even mandate encryption itself, so no local account or credential on the target is required.\nUI:N - Against an already-mounted share (fstab/autofs/persistent enterprise mounts) the server can emit encrypted responses and unsolicited oplock/lease-break messages that reach crypt_message() with no action by any user on the client.\nS:U - The use-after-free corrupts kernel slab memory within the same security authority as the affected component; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed allocation holds the scatterlist that the crypto driver walks to place decrypted output and the driver\u0027s private DMA context, so reallocation of that slab lets the hardware write plaintext into attacker-chosen memory and exposes kernel data, giving an arbitrary-read-grade disclosure primitive.\nI:H - The freed buffer contains req-\u003ebase.complete and req-\u003ebase.data, later invoked as req-\u003ecomplete(req-\u003edata, err), plus the sg pointers used for output DMA; spraying the freed slab during the accelerator round-trip yields a controlled indirect call and arbitrary kernel writes.\nA:H - Even without exploitation the defect reliably produces a slab use-after-free and NULL-pointer dereference in the crypto completion path, as documented in the changelog, crashing the kernel on every encrypted SMB message."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:19.784Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5d047b12f86cc3b9fde1171c02d9bccf4dba0632"
        },
        {
          "url": "https://git.kernel.org/stable/c/6550b2bef095d0dd2d2c8390d2ea4c3837028833"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a1d3e8d40f151c2d5a5f40c410e6e433f62f438"
        },
        {
          "url": "https://git.kernel.org/stable/c/15a0a5de49507062bc3be4014a403d8cea5533de"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a76bc2b24ed889a689fb1c9015307bf16aafb5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ac90f6824fc44d2e55a82503ddfc95defb19ae0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b220bed63330c0e1733dc06ea8e75d5b9962b6b6"
        }
      ],
      "title": "smb: client: fix use-after-free in crypt_message when using async crypto",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38488",
    "datePublished": "2025-07-28T11:21:52.085Z",
    "dateReserved": "2025-04-16T04:51:24.021Z",
    "dateUpdated": "2026-08-05T12:02:19.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38488",
      "date": "2026-09-27",
      "epss": "0.00677",
      "percentile": "0.50339"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:41:53.000Z",
      "cve": "CVE-2025-38488",
      "id": "msrc_CVE-2025-38488",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix use-after-free in crypt_message when using async crypto",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38488.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smb2ops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5d047b12f86cc3b9fde1171c02d9bccf4dba0632",
                    "status": "affected",
                    "version": "8f14a476abba13144df5434871a7225fd29af633",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6550b2bef095d0dd2d2c8390d2ea4c3837028833",
                    "status": "affected",
                    "version": "ef51c0d544b1518b35364480317ab6d3468f205d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9a1d3e8d40f151c2d5a5f40c410e6e433f62f438",
                    "status": "affected",
                    "version": "bce966530fd5542bbb422cb45ecb775f7a1a6bc3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "15a0a5de49507062bc3be4014a403d8cea5533de",
                    "status": "affected",
                    "version": "0809fb86ad13b29e1d6d491364fc7ea4fb545995",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2a76bc2b24ed889a689fb1c9015307bf16aafb5b",
                    "status": "affected",
                    "version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8ac90f6824fc44d2e55a82503ddfc95defb19ae0",
                    "status": "affected",
                    "version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b220bed63330c0e1733dc06ea8e75d5b9962b6b6",
                    "status": "affected",
                    "version": "b0abcd65ec545701b8793e12bc27dc98042b151a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "538c26d9bf70c90edc460d18c81008a4e555925a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.241",
                    "status": "affected",
                    "version": "5.10.237",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.190",
                    "status": "affected",
                    "version": "5.15.181",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.147",
                    "status": "affected",
                    "version": "6.1.128",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.100",
                    "status": "affected",
                    "version": "6.6.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "affected",
                    "version": "6.11.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smb2ops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.241",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.190",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.147",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.100",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "79C9B191-D12F-428B-9EEA-30BDCC83120A",
                    "versionEndExcluding": "5.10.241",
                    "versionStartIncluding": "5.10.237",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "61ADEC7C-D645-4175-8A33-7EB9E14A8FF4",
                    "versionEndExcluding": "5.15.190",
                    "versionStartIncluding": "5.15.181",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D856FFA-04F3-4A37-9907-A0BCF6B2031E",
                    "versionEndExcluding": "6.1.147",
                    "versionStartIncluding": "6.1.128",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4038CF7-63A2-4668-9428-4300CE199E7F",
                    "versionEndExcluding": "6.6.100",
                    "versionStartIncluding": "6.6.57",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B5676E16-8352-46DA-ADBA-D1030B261D95",
                    "versionEndExcluding": "6.12.40",
                    "versionStartIncluding": "6.11.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746",
                    "versionEndExcluding": "6.15.8",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in crypt_message when using async crypto\n\nThe CVE-2024-50047 fix removed asynchronous crypto handling from\ncrypt_message(), assuming all crypto operations are synchronous.\nHowever, when hardware crypto accelerators are used, this can cause\nuse-after-free crashes:\n\n  crypt_message()\n    // Allocate the creq buffer containing the req\n    creq = smb2_get_aead_req(..., \u0026req);\n\n    // Async encryption returns -EINPROGRESS immediately\n    rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);\n\n    // Free creq while async operation is still in progress\n    kvfree_sensitive(creq, ...);\n\nHardware crypto modules often implement async AEAD operations for\nperformance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,\nthe operation completes asynchronously. Without crypto_wait_req(),\nthe function immediately frees the request buffer, leading to crashes\nwhen the driver later accesses the freed memory.\n\nThis results in a use-after-free condition when the hardware crypto\ndriver later accesses the freed request structure, leading to kernel\ncrashes with NULL pointer dereferences.\n\nThe issue occurs because crypto_alloc_aead() with mask=0 doesn\u0027t\nguarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in\nthe mask, async implementations can be selected.\n\nFix by restoring the async crypto handling:\n- DECLARE_CRYPTO_WAIT(wait) for completion tracking\n- aead_request_set_callback() for async completion notification\n- crypto_wait_req() to wait for operation completion\n\nThis ensures the request buffer isn\u0027t freed until the crypto operation\ncompletes, whether synchronous or asynchronous, while preserving the\nCVE-2024-50047 fix."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: correcci\u00f3n del use-after-free en crypt_message al usar criptograf\u00eda as\u00edncrona. La correcci\u00f3n CVE-2024-50047 elimin\u00f3 el manejo de criptograf\u00eda as\u00edncrona de crypt_message(), asumiendo que todas las operaciones de criptograf\u00eda son s\u00edncronas. Sin embargo, cuando se usan aceleradores de criptograf\u00eda de hardware, esto puede causar fallos de use-after-free: crypt_message() // Asignar el b\u00fafer creq que contiene la solicitud creq = smb2_get_aead_req(..., \u0026amp;req); // El cifrado as\u00edncrono devuelve -EINPROGRESS inmediatamente rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); // Liberar creq mientras la operaci\u00f3n as\u00edncrona a\u00fan est\u00e1 en progreso kvfree_sensitive(creq, ...); Los m\u00f3dulos de criptograf\u00eda de hardware a menudo implementan operaciones AEAD as\u00edncronas para mejorar el rendimiento. Cuando crypto_aead_encrypt/decrypt() devuelve -EINPROGRESS, la operaci\u00f3n se completa de forma as\u00edncrona. Sin crypto_wait_req(), la funci\u00f3n libera inmediatamente el b\u00fafer de solicitud, lo que provoca fallos cuando el controlador accede posteriormente a la memoria liberada. Esto genera una condici\u00f3n de use-after-free cuando el controlador de cifrado de hardware accede posteriormente a la estructura de solicitud liberada, lo que provoca fallos del kernel con desreferencias de punteros NULL. El problema se produce porque crypto_alloc_aead() con mask=0 no garantiza la operaci\u00f3n s\u00edncrona. Incluso sin CRYPTO_ALG_ASYNC en la m\u00e1scara, se pueden seleccionar implementaciones as\u00edncronas. Soluci\u00f3n restaurando el manejo de criptograf\u00eda as\u00edncrona: - DECLARE_CRYPTO_WAIT(wait) para seguimiento de finalizaci\u00f3n - aead_request_set_callback() para notificaci\u00f3n de finalizaci\u00f3n as\u00edncrona - crypto_wait_req() para esperar a que se complete la operaci\u00f3n Esto garantiza que el b\u00fafer de solicitud no se libere hasta que se complete la operaci\u00f3n de criptograf\u00eda, ya sea sincr\u00f3nica o asincr\u00f3nica, al tiempo que se conserva la correcci\u00f3n CVE-2024-50047."
          }
        ],
        "id": "CVE-2025-38488",
        "lastModified": "2026-07-30T06:23:20.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-28T12:15:30.857",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/15a0a5de49507062bc3be4014a403d8cea5533de"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2a76bc2b24ed889a689fb1c9015307bf16aafb5b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5d047b12f86cc3b9fde1171c02d9bccf4dba0632"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6550b2bef095d0dd2d2c8390d2ea4c3837028833"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8ac90f6824fc44d2e55a82503ddfc95defb19ae0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9a1d3e8d40f151c2d5a5f40c410e6e433f62f438"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b220bed63330c0e1733dc06ea8e75d5b9962b6b6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:08:21+00:00",
      "cve": "CVE-2025-38488",
      "id": "CVE-2025-38488",
      "initial_release_date": "2025-07-28T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service in SMB client due to use-after-free in asynchronous crypto handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38488.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.