CVE-2025-38051 (GCVE-0-2025-38051)

Vulnerability from cvelistv5 – Published: 2025-06-18 09:33 – Updated: 2026-06-11 18:44
VLAI
Title
smb: client: Fix use-after-free in cifs_fill_dirent
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warning. ================================================================== BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs] Read of size 4 at addr ffff8880099b819c by task a.out/342975 CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x640 kasan_report+0xb8/0xf0 cifs_fill_dirent+0xb03/0xb60 [cifs] cifs_readdir+0x12cb/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f996f64b9f9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8 RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88 R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000 </TASK> Allocated by task 408: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_noprof+0x117/0x3d0 mempool_alloc_noprof+0xf2/0x2c0 cifs_buf_get+0x36/0x80 [cifs] allocate_buffers+0x1d2/0x330 [cifs] cifs_demultiplex_thread+0x22b/0x2690 [cifs] kthread+0x394/0x720 ret_from_fork+0x34/0x70 ret_from_fork_asm+0x1a/0x30 Freed by task 342979: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kmem_cache_free+0x2b8/0x500 cifs_buf_release+0x3c/0x70 [cifs] cifs_readdir+0x1c97/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e The buggy address belongs to the object at ffff8880099b8000 which belongs to the cache cifs_request of size 16588 The buggy address is located 412 bytes inside of freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== POC is available in the link [1]. The problem triggering process is as follows: Process 1 Process 2 ----------------------------------- ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a364bc0b37f14ffd66c1f982af42990a9d77fa43 , < aee067e88d61eb72e966f094e4749c6b14e7008f (git)
Affected: a364bc0b37f14ffd66c1f982af42990a9d77fa43 , < a24c2f05ac3c5b0aaa539d9d913826d2643dfd0e (git)
Affected: a364bc0b37f14ffd66c1f982af42990a9d77fa43 , < 1b197931fbc821bc7e9e91bf619400db563e3338 (git)
Affected: a364bc0b37f14ffd66c1f982af42990a9d77fa43 , < c8623231e0edfcccb7cc6add0288fa0f0594282f (git)
Affected: a364bc0b37f14ffd66c1f982af42990a9d77fa43 , < 73cadde98f67f76c5eba00ac0b72c453383cec8b (git)
Affected: a364bc0b37f14ffd66c1f982af42990a9d77fa43 , < 9bea368648ac46f8593a780760362e40291d22a9 (git)
Affected: a364bc0b37f14ffd66c1f982af42990a9d77fa43 , < 9c9aafbacc183598f064902365e107b5e856531f (git)
Affected: a364bc0b37f14ffd66c1f982af42990a9d77fa43 , < a7a8fe56e932a36f43e031b398aef92341bf5ea0 (git)
Affected: 0f3da51e7046e2eb28992ba65c22d058f571356c (git)
Affected: 2.6.27.4 , < 2.6.28 (semver)
Create a notification for this product.
Linux Linux Affected: 2.6.28
Unaffected: 0 , < 2.6.28 (semver)
Unaffected: 5.4.294 , ≤ 5.4.* (semver)
Unaffected: 5.10.238 , ≤ 5.10.* (semver)
Unaffected: 5.15.185 , ≤ 5.15.* (semver)
Unaffected: 6.1.141 , ≤ 6.1.* (semver)
Unaffected: 6.6.93 , ≤ 6.6.* (semver)
Unaffected: 6.12.31 , ≤ 6.12.* (semver)
Unaffected: 6.14.9 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:33:23.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38051",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:50.583980Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:16.726Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/readdir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aee067e88d61eb72e966f094e4749c6b14e7008f",
              "status": "affected",
              "version": "a364bc0b37f14ffd66c1f982af42990a9d77fa43",
              "versionType": "git"
            },
            {
              "lessThan": "a24c2f05ac3c5b0aaa539d9d913826d2643dfd0e",
              "status": "affected",
              "version": "a364bc0b37f14ffd66c1f982af42990a9d77fa43",
              "versionType": "git"
            },
            {
              "lessThan": "1b197931fbc821bc7e9e91bf619400db563e3338",
              "status": "affected",
              "version": "a364bc0b37f14ffd66c1f982af42990a9d77fa43",
              "versionType": "git"
            },
            {
              "lessThan": "c8623231e0edfcccb7cc6add0288fa0f0594282f",
              "status": "affected",
              "version": "a364bc0b37f14ffd66c1f982af42990a9d77fa43",
              "versionType": "git"
            },
            {
              "lessThan": "73cadde98f67f76c5eba00ac0b72c453383cec8b",
              "status": "affected",
              "version": "a364bc0b37f14ffd66c1f982af42990a9d77fa43",
              "versionType": "git"
            },
            {
              "lessThan": "9bea368648ac46f8593a780760362e40291d22a9",
              "status": "affected",
              "version": "a364bc0b37f14ffd66c1f982af42990a9d77fa43",
              "versionType": "git"
            },
            {
              "lessThan": "9c9aafbacc183598f064902365e107b5e856531f",
              "status": "affected",
              "version": "a364bc0b37f14ffd66c1f982af42990a9d77fa43",
              "versionType": "git"
            },
            {
              "lessThan": "a7a8fe56e932a36f43e031b398aef92341bf5ea0",
              "status": "affected",
              "version": "a364bc0b37f14ffd66c1f982af42990a9d77fa43",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0f3da51e7046e2eb28992ba65c22d058f571356c",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.28",
              "status": "affected",
              "version": "2.6.27.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/readdir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.28"
            },
            {
              "lessThan": "2.6.28",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.294",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.294",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.185",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.141",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.93",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.27.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_fill_dirent\n\nThere is a race condition in the readdir concurrency process, which may\naccess the rsp buffer after it has been released, triggering the\nfollowing KASAN warning.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]\n Read of size 4 at addr ffff8880099b819c by task a.out/342975\n\n CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x53/0x70\n  print_report+0xce/0x640\n  kasan_report+0xb8/0xf0\n  cifs_fill_dirent+0xb03/0xb60 [cifs]\n  cifs_readdir+0x12cb/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f996f64b9f9\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89\n f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01\n f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8\n RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e\n RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\n RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88\n R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000\n  \u003c/TASK\u003e\n\n Allocated by task 408:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  __kasan_slab_alloc+0x6e/0x70\n  kmem_cache_alloc_noprof+0x117/0x3d0\n  mempool_alloc_noprof+0xf2/0x2c0\n  cifs_buf_get+0x36/0x80 [cifs]\n  allocate_buffers+0x1d2/0x330 [cifs]\n  cifs_demultiplex_thread+0x22b/0x2690 [cifs]\n  kthread+0x394/0x720\n  ret_from_fork+0x34/0x70\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 342979:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x37/0x50\n  kmem_cache_free+0x2b8/0x500\n  cifs_buf_release+0x3c/0x70 [cifs]\n  cifs_readdir+0x1c97/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents64+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n The buggy address belongs to the object at ffff8880099b8000\n  which belongs to the cache cifs_request of size 16588\n The buggy address is located 412 bytes inside of\n  freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n anon flags: 0x80000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n \u003effff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                             ^\n  ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ==================================================================\n\nPOC is available in the link [1].\n\nThe problem triggering process is as follows:\n\nProcess 1                       Process 2\n-----------------------------------\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:58:52.888Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aee067e88d61eb72e966f094e4749c6b14e7008f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a24c2f05ac3c5b0aaa539d9d913826d2643dfd0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b197931fbc821bc7e9e91bf619400db563e3338"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8623231e0edfcccb7cc6add0288fa0f0594282f"
        },
        {
          "url": "https://git.kernel.org/stable/c/73cadde98f67f76c5eba00ac0b72c453383cec8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bea368648ac46f8593a780760362e40291d22a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c9aafbacc183598f064902365e107b5e856531f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7a8fe56e932a36f43e031b398aef92341bf5ea0"
        }
      ],
      "title": "smb: client: Fix use-after-free in cifs_fill_dirent",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38051",
    "datePublished": "2025-06-18T09:33:32.805Z",
    "dateReserved": "2025-04-16T04:51:23.979Z",
    "dateUpdated": "2026-06-11T18:44:16.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38051",
      "date": "2026-06-19",
      "epss": "0.00177",
      "percentile": "0.07392"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38051\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T10:15:37.693\",\"lastModified\":\"2026-01-12T13:11:24.650\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: Fix use-after-free in cifs_fill_dirent\\n\\nThere is a race condition in the readdir concurrency process, which may\\naccess the rsp buffer after it has been released, triggering the\\nfollowing KASAN warning.\\n\\n ==================================================================\\n BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]\\n Read of size 4 at addr ffff8880099b819c by task a.out/342975\\n\\n CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)\\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x53/0x70\\n  print_report+0xce/0x640\\n  kasan_report+0xb8/0xf0\\n  cifs_fill_dirent+0xb03/0xb60 [cifs]\\n  cifs_readdir+0x12cb/0x3190 [cifs]\\n  iterate_dir+0x1a1/0x520\\n  __x64_sys_getdents+0x134/0x220\\n  do_syscall_64+0x4b/0x110\\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n RIP: 0033:0x7f996f64b9f9\\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89\\n f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01\\n f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8\\n RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e\\n RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9\\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\\n RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000\\n R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88\\n R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000\\n  \u003c/TASK\u003e\\n\\n Allocated by task 408:\\n  kasan_save_stack+0x20/0x40\\n  kasan_save_track+0x14/0x30\\n  __kasan_slab_alloc+0x6e/0x70\\n  kmem_cache_alloc_noprof+0x117/0x3d0\\n  mempool_alloc_noprof+0xf2/0x2c0\\n  cifs_buf_get+0x36/0x80 [cifs]\\n  allocate_buffers+0x1d2/0x330 [cifs]\\n  cifs_demultiplex_thread+0x22b/0x2690 [cifs]\\n  kthread+0x394/0x720\\n  ret_from_fork+0x34/0x70\\n  ret_from_fork_asm+0x1a/0x30\\n\\n Freed by task 342979:\\n  kasan_save_stack+0x20/0x40\\n  kasan_save_track+0x14/0x30\\n  kasan_save_free_info+0x3b/0x60\\n  __kasan_slab_free+0x37/0x50\\n  kmem_cache_free+0x2b8/0x500\\n  cifs_buf_release+0x3c/0x70 [cifs]\\n  cifs_readdir+0x1c97/0x3190 [cifs]\\n  iterate_dir+0x1a1/0x520\\n  __x64_sys_getdents64+0x134/0x220\\n  do_syscall_64+0x4b/0x110\\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n The buggy address belongs to the object at ffff8880099b8000\\n  which belongs to the cache cifs_request of size 16588\\n The buggy address is located 412 bytes inside of\\n  freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)\\n\\n The buggy address belongs to the physical page:\\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8\\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\n anon flags: 0x80000000000040(head|node=0|zone=1)\\n page_type: f5(slab)\\n raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\\n raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\\n head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\\n head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\\n head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff\\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n  ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n  ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n \u003effff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n                             ^\\n  ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n  ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n ==================================================================\\n\\nPOC is available in the link [1].\\n\\nThe problem triggering process is as follows:\\n\\nProcess 1                       Process 2\\n-----------------------------------\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: Se corrige el use-after-free en cifs_fill_dirent Hay una condici\u00f3n de ejecuci\u00f3n en el proceso de concurrencia readdir, que puede acceder al b\u00fafer rsp despu\u00e9s de que se haya liberado, lo que activa la siguiente advertencia KASAN. ======================================================================== ERROR: KASAN: slab-use-after-free en cifs_fill_dirent+0xb03/0xb60 [cifs] Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff8880099b819c por la tarea a.out/342975 CPU: 2 UID: 0 PID: 342975 Comm: a.out No contaminado 6.15.0-rc6+ #240 PREEMPT(full) Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 01/04/2014 Rastreo de llamadas:   dump_stack_lvl+0x53/0x70 print_report+0xce/0x640 kasan_report+0xb8/0xf0 cifs_fill_dirent+0xb03/0xb60 [cifs] cifs_readdir+0x12cb/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f996f64b9f9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8 RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88 R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000  Allocated by task 408: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_noprof+0x117/0x3d0 mempool_alloc_noprof+0xf2/0x2c0 cifs_buf_get+0x36/0x80 [cifs] allocate_buffers+0x1d2/0x330 [cifs] cifs_demultiplex_thread+0x22b/0x2690 [cifs] kthread+0x394/0x720 ret_from_fork+0x34/0x70 ret_from_fork_asm+0x1a/0x30 Freed by task 342979: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kmem_cache_free+0x2b8/0x500 cifs_buf_release+0x3c/0x70 [cifs] cifs_readdir+0x1c97/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e La direcci\u00f3n con errores pertenece al objeto en ffff8880099b8000 que pertenece a la cach\u00e9 cifs_request de tama\u00f1o 16588 La direcci\u00f3n con errores se encuentra a 412 bytes dentro de la regi\u00f3n liberada de 16588 bytes [ffff8880099b8000, ffff8880099bc0cc) La direcci\u00f3n con errores pertenece a la p\u00e1gina f\u00edsica: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb \u0026gt;ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== La prueba de concepto (POC) est\u00e1 disponible en el enlace [1]. El proceso que desencadena el problema es el siguiente: Proceso 1 Proceso 2 ----------------------------------- ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.27.4\",\"versionEndExcluding\":\"5.4.294\",\"matchCriteriaId\":\"5FA5A982-9273-4789-8594-A097AA47C0DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.238\",\"matchCriteriaId\":\"0DAAEF7F-D560-47FC-8B65-20404DB82432\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.185\",\"matchCriteriaId\":\"E11820B2-24BD-40A8-9E6B-5BC447252321\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.141\",\"matchCriteriaId\":\"7CEA8241-A858-4009-B4EE-31C62772811A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.93\",\"matchCriteriaId\":\"50A4A9DE-24AB-4FB4-AACD-85D8EABB0571\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.31\",\"matchCriteriaId\":\"1AE98841-5774-4B45-A81C-2D188DB7E5C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.9\",\"matchCriteriaId\":\"A9B72DD1-715C-4101-A720-1C8D70044C06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"90320558-E553-4EF5-8A0B-0F5D20113BD2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C300BA32-5854-4B59-A00A-18A402F291D0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b197931fbc821bc7e9e91bf619400db563e3338\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/73cadde98f67f76c5eba00ac0b72c453383cec8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9bea368648ac46f8593a780760362e40291d22a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c9aafbacc183598f064902365e107b5e856531f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a24c2f05ac3c5b0aaa539d9d913826d2643dfd0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7a8fe56e932a36f43e031b398aef92341bf5ea0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aee067e88d61eb72e966f094e4749c6b14e7008f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c8623231e0edfcccb7cc6add0288fa0f0594282f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T17:33:23.156Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38051\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:41:50.583980Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:38:47.228Z\"}}], \"cna\": {\"title\": \"smb: client: Fix use-after-free in cifs_fill_dirent\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a364bc0b37f14ffd66c1f982af42990a9d77fa43\", \"lessThan\": \"aee067e88d61eb72e966f094e4749c6b14e7008f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a364bc0b37f14ffd66c1f982af42990a9d77fa43\", \"lessThan\": \"a24c2f05ac3c5b0aaa539d9d913826d2643dfd0e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a364bc0b37f14ffd66c1f982af42990a9d77fa43\", \"lessThan\": \"1b197931fbc821bc7e9e91bf619400db563e3338\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a364bc0b37f14ffd66c1f982af42990a9d77fa43\", \"lessThan\": \"c8623231e0edfcccb7cc6add0288fa0f0594282f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a364bc0b37f14ffd66c1f982af42990a9d77fa43\", \"lessThan\": \"73cadde98f67f76c5eba00ac0b72c453383cec8b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a364bc0b37f14ffd66c1f982af42990a9d77fa43\", \"lessThan\": \"9bea368648ac46f8593a780760362e40291d22a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a364bc0b37f14ffd66c1f982af42990a9d77fa43\", \"lessThan\": \"9c9aafbacc183598f064902365e107b5e856531f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a364bc0b37f14ffd66c1f982af42990a9d77fa43\", \"lessThan\": \"a7a8fe56e932a36f43e031b398aef92341bf5ea0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0f3da51e7046e2eb28992ba65c22d058f571356c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2.6.27.4\", \"lessThan\": \"2.6.28\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/smb/client/readdir.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.28\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.28\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.294\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.238\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.185\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.141\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.14.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/client/readdir.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/aee067e88d61eb72e966f094e4749c6b14e7008f\"}, {\"url\": \"https://git.kernel.org/stable/c/a24c2f05ac3c5b0aaa539d9d913826d2643dfd0e\"}, {\"url\": \"https://git.kernel.org/stable/c/1b197931fbc821bc7e9e91bf619400db563e3338\"}, {\"url\": \"https://git.kernel.org/stable/c/c8623231e0edfcccb7cc6add0288fa0f0594282f\"}, {\"url\": \"https://git.kernel.org/stable/c/73cadde98f67f76c5eba00ac0b72c453383cec8b\"}, {\"url\": \"https://git.kernel.org/stable/c/9bea368648ac46f8593a780760362e40291d22a9\"}, {\"url\": \"https://git.kernel.org/stable/c/9c9aafbacc183598f064902365e107b5e856531f\"}, {\"url\": \"https://git.kernel.org/stable/c/a7a8fe56e932a36f43e031b398aef92341bf5ea0\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: Fix use-after-free in cifs_fill_dirent\\n\\nThere is a race condition in the readdir concurrency process, which may\\naccess the rsp buffer after it has been released, triggering the\\nfollowing KASAN warning.\\n\\n ==================================================================\\n BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]\\n Read of size 4 at addr ffff8880099b819c by task a.out/342975\\n\\n CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)\\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x53/0x70\\n  print_report+0xce/0x640\\n  kasan_report+0xb8/0xf0\\n  cifs_fill_dirent+0xb03/0xb60 [cifs]\\n  cifs_readdir+0x12cb/0x3190 [cifs]\\n  iterate_dir+0x1a1/0x520\\n  __x64_sys_getdents+0x134/0x220\\n  do_syscall_64+0x4b/0x110\\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n RIP: 0033:0x7f996f64b9f9\\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89\\n f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01\\n f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8\\n RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e\\n RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9\\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\\n RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000\\n R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88\\n R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000\\n  \u003c/TASK\u003e\\n\\n Allocated by task 408:\\n  kasan_save_stack+0x20/0x40\\n  kasan_save_track+0x14/0x30\\n  __kasan_slab_alloc+0x6e/0x70\\n  kmem_cache_alloc_noprof+0x117/0x3d0\\n  mempool_alloc_noprof+0xf2/0x2c0\\n  cifs_buf_get+0x36/0x80 [cifs]\\n  allocate_buffers+0x1d2/0x330 [cifs]\\n  cifs_demultiplex_thread+0x22b/0x2690 [cifs]\\n  kthread+0x394/0x720\\n  ret_from_fork+0x34/0x70\\n  ret_from_fork_asm+0x1a/0x30\\n\\n Freed by task 342979:\\n  kasan_save_stack+0x20/0x40\\n  kasan_save_track+0x14/0x30\\n  kasan_save_free_info+0x3b/0x60\\n  __kasan_slab_free+0x37/0x50\\n  kmem_cache_free+0x2b8/0x500\\n  cifs_buf_release+0x3c/0x70 [cifs]\\n  cifs_readdir+0x1c97/0x3190 [cifs]\\n  iterate_dir+0x1a1/0x520\\n  __x64_sys_getdents64+0x134/0x220\\n  do_syscall_64+0x4b/0x110\\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n The buggy address belongs to the object at ffff8880099b8000\\n  which belongs to the cache cifs_request of size 16588\\n The buggy address is located 412 bytes inside of\\n  freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)\\n\\n The buggy address belongs to the physical page:\\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8\\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\n anon flags: 0x80000000000040(head|node=0|zone=1)\\n page_type: f5(slab)\\n raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\\n raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\\n head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\\n head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\\n head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff\\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n  ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n  ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n \u003effff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n                             ^\\n  ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n  ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n ==================================================================\\n\\nPOC is available in the link [1].\\n\\nThe problem triggering process is as follows:\\n\\nProcess 1                       Process 2\\n-----------------------------------\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.294\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.238\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.185\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.141\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.93\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.31\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14.9\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"2.6.27.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:58:52.888Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-38051\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:16.726Z\", \"dateReserved\": \"2025-04-16T04:51:23.979Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-06-18T09:33:32.805Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.