CVE-2025-38523

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-38523
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38523.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38523
Downstream
Related
Published
2025-08-16T11:12:17Z
Modified
2025-10-18T04:26:59.278385Z
Summary
cifs: Fix the smbd_response slab to allow usercopy
Details

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix the smbd_response slab to allow usercopy

The handling of received data in the smbdirect client code involves using copytoiter() to copy data from the smbd_reponse struct's packet trailer to a folioq buffer provided by netfslib that encapsulates a chunk of pagecache.

If, however, CONFIGHARDENEDUSERCOPY=y, this will result in the checks then performed in copytoiter() oopsing with something like the following:

CIFS: Attempting to mount //172.31.9.1/test CIFS: VFS: RDMA transport established usercopy: Kernel memory exposure attempt detected from SLUB object 'smbdresponse0000000091e24ea1' (offset 81, size 63)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102! ... RIP: 0010:usercopyabort+0x6c/0x80 ... Call Trace: <TASK> _checkheapobject+0xe3/0x120 _checkobjectsize+0x4dc/0x6d0 smbdrecv+0x77f/0xfe0 [cifs] cifsreadvfromsocket+0x276/0x8f0 [cifs] cifsreadfromsocket+0xcd/0x120 [cifs] cifsdemultiplexthread+0x7e9/0x2d50 [cifs] kthread+0x396/0x830 retfromfork+0x2b8/0x3b0 retfromfork_asm+0x1a/0x30

The problem is that the smbd_response slab's packet field isn't marked as being permitted for usercopy.

Fix this by passing parameters to kmemslabcreate() to indicate that copytoiter() is permitted from the packet region of the smbd_response slab objects, less the header space.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ee4cdf7ba857a894ad1650d6ab77669cbbfa329e
Fixed
87dcc7e33fc3dcb8ed32333cec016528b5bb6ce4
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ee4cdf7ba857a894ad1650d6ab77669cbbfa329e
Fixed
f0dd353d47f7051afa98c6c60c7486831eb1a410
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ee4cdf7ba857a894ad1650d6ab77669cbbfa329e
Fixed
43e7e284fc77b710d899569360ea46fa3374ae22

Affected versions

v6.*

v6.11
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.23
v6.12.24
v6.12.25
v6.12.26
v6.12.27
v6.12.28
v6.12.29
v6.12.3
v6.12.30
v6.12.31
v6.12.32
v6.12.33
v6.12.34
v6.12.35
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.15
v6.15-rc1
v6.15-rc2
v6.15-rc3
v6.15-rc4
v6.15-rc5
v6.15-rc6
v6.15-rc7
v6.15.1
v6.15.2
v6.15.3
v6.15.4
v6.15.5
v6.15.6
v6.15.7
v6.16-rc1
v6.16-rc2
v6.16-rc3

Database specific

vanir_signatures

[
    {
        "digest": {
            "length": 1496.0,
            "function_hash": "319679769667314457362155754660554007917"
        },
        "signature_type": "Function",
        "target": {
            "function": "allocate_caches_and_workqueue",
            "file": "fs/smb/client/smbdirect.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87dcc7e33fc3dcb8ed32333cec016528b5bb6ce4",
        "signature_version": "v1",
        "id": "CVE-2025-38523-21547ab6"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "28170225954107430247323159730676320020",
                "336291124663986514459211302596800592716",
                "257309417192449204249069059911633169145",
                "158022460895654171565396012652568853690",
                "32458689951909908038324256154985459684",
                "262958454847096054936740918682271626718",
                "182065204139066219092171294580485139399",
                "62832154339826377071339474314900731798",
                "111172899188612269360414951658343399212",
                "33318582677571224396025220938062350302",
                "338239333871298829882806573990507326505",
                "177091869675630216044117975283467698383",
                "219735154281459480943416414293391441951"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "fs/smb/client/smbdirect.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87dcc7e33fc3dcb8ed32333cec016528b5bb6ce4",
        "signature_version": "v1",
        "id": "CVE-2025-38523-605b3796"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "28170225954107430247323159730676320020",
                "336291124663986514459211302596800592716",
                "257309417192449204249069059911633169145",
                "158022460895654171565396012652568853690",
                "32458689951909908038324256154985459684",
                "262958454847096054936740918682271626718",
                "182065204139066219092171294580485139399",
                "62832154339826377071339474314900731798",
                "111172899188612269360414951658343399212",
                "33318582677571224396025220938062350302",
                "338239333871298829882806573990507326505",
                "177091869675630216044117975283467698383",
                "219735154281459480943416414293391441951"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "fs/smb/client/smbdirect.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e7e284fc77b710d899569360ea46fa3374ae22",
        "signature_version": "v1",
        "id": "CVE-2025-38523-f4a67315"
    },
    {
        "digest": {
            "length": 1496.0,
            "function_hash": "319679769667314457362155754660554007917"
        },
        "signature_type": "Function",
        "target": {
            "function": "allocate_caches_and_workqueue",
            "file": "fs/smb/client/smbdirect.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0dd353d47f7051afa98c6c60c7486831eb1a410",
        "signature_version": "v1",
        "id": "CVE-2025-38523-f574d701"
    },
    {
        "digest": {
            "length": 1496.0,
            "function_hash": "319679769667314457362155754660554007917"
        },
        "signature_type": "Function",
        "target": {
            "function": "allocate_caches_and_workqueue",
            "file": "fs/smb/client/smbdirect.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e7e284fc77b710d899569360ea46fa3374ae22",
        "signature_version": "v1",
        "id": "CVE-2025-38523-f8f10da4"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "28170225954107430247323159730676320020",
                "336291124663986514459211302596800592716",
                "257309417192449204249069059911633169145",
                "158022460895654171565396012652568853690",
                "32458689951909908038324256154985459684",
                "262958454847096054936740918682271626718",
                "182065204139066219092171294580485139399",
                "62832154339826377071339474314900731798",
                "111172899188612269360414951658343399212",
                "33318582677571224396025220938062350302",
                "338239333871298829882806573990507326505",
                "177091869675630216044117975283467698383",
                "219735154281459480943416414293391441951"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "fs/smb/client/smbdirect.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0dd353d47f7051afa98c6c60c7486831eb1a410",
        "signature_version": "v1",
        "id": "CVE-2025-38523-fab5b8a6"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.12.0
Fixed
6.12.36
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.8