In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in decryption with multichannel
After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async decryption"), the channels started reusing AEAD TFM from primary channel to perform synchronous decryption, but that can't done as there could be multiple cifsd threads (one per channel) simultaneously accessing it to perform decryption.
This fixes the following KASAN splat when running fstest generic/249 with 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows Server 2022:
BUG: KASAN: slab-use-after-free in gf128mul4klle+0xba/0x110 Read of size 8 at addr ffff8881046c18a0 by task cifsd/986 CPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x5d/0x80 printreport+0x156/0x528 ? gf128mul4klle+0xba/0x110 ? virtaddrvalid+0x145/0x300 ? _physaddr+0x46/0x90 ? gf128mul4klle+0xba/0x110 kasanreport+0xdf/0x1a0 ? gf128mul4klle+0xba/0x110 gf128mul4klle+0xba/0x110 ghashupdate+0x189/0x210 shashahashupdate+0x295/0x370 ? _pfxshashahashupdate+0x10/0x10 ? _pfxshashahashupdate+0x10/0x10 ? _pfxextractitertosg+0x10/0x10 ? kmalloclargenode+0x10e/0x180 ? asanmemset+0x23/0x50 cryptoahashupdate+0x3c/0xc0 gcmhashassocremaincontinue+0x93/0xc0 cryptmessage+0xe09/0xec0 [cifs] ? _pfxcryptmessage+0x10/0x10 [cifs] ? rawspinunlock+0x23/0x40 ? _pfxcifsreadvfromsocket+0x10/0x10 [cifs] decryptrawdata+0x229/0x380 [cifs] ? _pfxdecryptrawdata+0x10/0x10 [cifs] ? _pfxcifsreaditerfromsocket+0x10/0x10 [cifs] smb3receivetransform+0x837/0xc80 [cifs] ? _pfxsmb3receivetransform+0x10/0x10 [cifs] ? _pfxmightresched+0x10/0x10 ? _pfxsmb3istransformhdr+0x10/0x10 [cifs] cifsdemultiplexthread+0x692/0x1570 [cifs] ? _pfxcifsdemultiplexthread+0x10/0x10 [cifs] ? rcuiswatching+0x20/0x50 ? rculockdepcurrentcpuonline+0x62/0xb0 ? findheldlock+0x32/0x90 ? kvmschedclockread+0x11/0x20 ? localclocknoinstr+0xd/0xd0 ? traceirqenable.constprop.0+0xa8/0xe0 ? _pfxcifsdemultiplexthread+0x10/0x10 [cifs] kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? _pfxkthread+0x10/0x10 ? localclocknoinstr+0xd/0xd0 ? retfromfork+0x1b/0x60 ? localclock+0x15/0x30 ? lockrelease+0x29b/0x390 ? rcuiswatching+0x20/0x50 ? _pfxkthread+0x10/0x10 retfromfork+0x31/0x60 ? _pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@950557922c1298464749c216d8763e97faf5d0a6",
"id": "CVE-2025-37750-09a634e7",
"digest": {
"function_hash": "321768783408864673461102450089418741419",
"length": 524.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "cifs_crypto_secmech_release",
"file": "fs/smb/client/cifsencrypt.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e859b216d94668bc66330e61be201234f4413d1a",
"id": "CVE-2025-37750-0a3f6b2f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11216424938979169227070544887468899045",
"299115165734995642301554689651603749132",
"231141793472707865737006086148971067358",
"285701044730667719915406972334015679439",
"260084459007541190574167948638380367168"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/smb2ops.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9502dd5c7029902f4a425bf959917a5a9e7c0e50",
"id": "CVE-2025-37750-15f69f3a",
"digest": {
"function_hash": "155519748428286400434329420077476084168",
"length": 6653.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "SMB2_negotiate",
"file": "fs/smb/client/smb2pdu.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15",
"id": "CVE-2025-37750-2779b376",
"digest": {
"function_hash": "321768783408864673461102450089418741419",
"length": 524.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "cifs_crypto_secmech_release",
"file": "fs/smb/client/cifsencrypt.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15",
"id": "CVE-2025-37750-294fd244",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243468560999874653727375478193234774218",
"74175947203916084238220904841123168465",
"66599269045301986463890787063422684350",
"41298275886021351763061459328689215416",
"168386999032253718580201028836075431339",
"129916067710175399182364092327085954354",
"269123336022816046873428512638320783551",
"142090733978196814532545817964110145130",
"271795034023062637371085527403427262248",
"168913999804006391453927654061766594263",
"192986917693110761637056509203193489695",
"35644078256510685314982167089928970313",
"230555651786202580305236487605803790304",
"292499824628910967820752142573786750533"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/cifsencrypt.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@950557922c1298464749c216d8763e97faf5d0a6",
"id": "CVE-2025-37750-2b37df5d",
"digest": {
"function_hash": "176691498119242792393306197304516390743",
"length": 1204.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "decrypt_raw_data",
"file": "fs/smb/client/smb2ops.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e859b216d94668bc66330e61be201234f4413d1a",
"id": "CVE-2025-37750-2c5fccb5",
"digest": {
"function_hash": "155519748428286400434329420077476084168",
"length": 6653.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "SMB2_negotiate",
"file": "fs/smb/client/smb2pdu.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@950557922c1298464749c216d8763e97faf5d0a6",
"id": "CVE-2025-37750-436d4b96",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11216424938979169227070544887468899045",
"299115165734995642301554689651603749132",
"231141793472707865737006086148971067358",
"285701044730667719915406972334015679439",
"260084459007541190574167948638380367168"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/smb2ops.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e859b216d94668bc66330e61be201234f4413d1a",
"id": "CVE-2025-37750-493d4fad",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243468560999874653727375478193234774218",
"74175947203916084238220904841123168465",
"66599269045301986463890787063422684350",
"41298275886021351763061459328689215416",
"168386999032253718580201028836075431339",
"129916067710175399182364092327085954354",
"269123336022816046873428512638320783551",
"142090733978196814532545817964110145130",
"271795034023062637371085527403427262248",
"168913999804006391453927654061766594263",
"192986917693110761637056509203193489695",
"35644078256510685314982167089928970313",
"230555651786202580305236487605803790304",
"292499824628910967820752142573786750533"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/cifsencrypt.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9502dd5c7029902f4a425bf959917a5a9e7c0e50",
"id": "CVE-2025-37750-6c9c1d20",
"digest": {
"function_hash": "176691498119242792393306197304516390743",
"length": 1204.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "decrypt_raw_data",
"file": "fs/smb/client/smb2ops.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@950557922c1298464749c216d8763e97faf5d0a6",
"id": "CVE-2025-37750-7306ede1",
"digest": {
"function_hash": "155519748428286400434329420077476084168",
"length": 6653.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "SMB2_negotiate",
"file": "fs/smb/client/smb2pdu.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9502dd5c7029902f4a425bf959917a5a9e7c0e50",
"id": "CVE-2025-37750-76a5bc72",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243468560999874653727375478193234774218",
"74175947203916084238220904841123168465",
"66599269045301986463890787063422684350",
"41298275886021351763061459328689215416",
"168386999032253718580201028836075431339",
"129916067710175399182364092327085954354",
"269123336022816046873428512638320783551",
"142090733978196814532545817964110145130",
"271795034023062637371085527403427262248",
"168913999804006391453927654061766594263",
"192986917693110761637056509203193489695",
"35644078256510685314982167089928970313",
"230555651786202580305236487605803790304",
"292499824628910967820752142573786750533"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/cifsencrypt.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@950557922c1298464749c216d8763e97faf5d0a6",
"id": "CVE-2025-37750-7a371a9f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243468560999874653727375478193234774218",
"74175947203916084238220904841123168465",
"66599269045301986463890787063422684350",
"41298275886021351763061459328689215416",
"168386999032253718580201028836075431339",
"129916067710175399182364092327085954354",
"269123336022816046873428512638320783551",
"142090733978196814532545817964110145130",
"271795034023062637371085527403427262248",
"168913999804006391453927654061766594263",
"192986917693110761637056509203193489695",
"35644078256510685314982167089928970313",
"230555651786202580305236487605803790304",
"292499824628910967820752142573786750533"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/cifsencrypt.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15",
"id": "CVE-2025-37750-8cd62a1d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256743053303915673529944914931870958827",
"192814949332771341801618035507215039527",
"57001548803571292978440379364531624053",
"161137391093632888216179183885106639962",
"257865797142774498224609869970624537360",
"24727107574026949846979513161686933899",
"181761718072006103829533325854116262247",
"309270372332757332771683973954077887087",
"141086989713261774696610621406423304343",
"260348328504200305376598084539564569771",
"56398131911477848941003013739491518425"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/smb2pdu.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15",
"id": "CVE-2025-37750-91104c72",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11216424938979169227070544887468899045",
"299115165734995642301554689651603749132",
"231141793472707865737006086148971067358",
"285701044730667719915406972334015679439",
"260084459007541190574167948638380367168"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/smb2ops.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@950557922c1298464749c216d8763e97faf5d0a6",
"id": "CVE-2025-37750-95b7cfd5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256743053303915673529944914931870958827",
"192814949332771341801618035507215039527",
"57001548803571292978440379364531624053",
"161137391093632888216179183885106639962",
"257865797142774498224609869970624537360",
"24727107574026949846979513161686933899",
"181761718072006103829533325854116262247",
"309270372332757332771683973954077887087",
"141086989713261774696610621406423304343",
"260348328504200305376598084539564569771",
"56398131911477848941003013739491518425"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/smb2pdu.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9502dd5c7029902f4a425bf959917a5a9e7c0e50",
"id": "CVE-2025-37750-a2a594ca",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11216424938979169227070544887468899045",
"299115165734995642301554689651603749132",
"231141793472707865737006086148971067358",
"285701044730667719915406972334015679439",
"260084459007541190574167948638380367168"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/smb2ops.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e859b216d94668bc66330e61be201234f4413d1a",
"id": "CVE-2025-37750-b2bc9e84",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256743053303915673529944914931870958827",
"192814949332771341801618035507215039527",
"57001548803571292978440379364531624053",
"161137391093632888216179183885106639962",
"257865797142774498224609869970624537360",
"24727107574026949846979513161686933899",
"181761718072006103829533325854116262247",
"309270372332757332771683973954077887087",
"141086989713261774696610621406423304343",
"260348328504200305376598084539564569771",
"56398131911477848941003013739491518425"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/smb2pdu.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9502dd5c7029902f4a425bf959917a5a9e7c0e50",
"id": "CVE-2025-37750-b633d199",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256743053303915673529944914931870958827",
"192814949332771341801618035507215039527",
"57001548803571292978440379364531624053",
"161137391093632888216179183885106639962",
"257865797142774498224609869970624537360",
"24727107574026949846979513161686933899",
"181761718072006103829533325854116262247",
"309270372332757332771683973954077887087",
"141086989713261774696610621406423304343",
"260348328504200305376598084539564569771",
"56398131911477848941003013739491518425"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/smb/client/smb2pdu.c"
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15",
"id": "CVE-2025-37750-c8969986",
"digest": {
"function_hash": "176691498119242792393306197304516390743",
"length": 1204.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "decrypt_raw_data",
"file": "fs/smb/client/smb2ops.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e859b216d94668bc66330e61be201234f4413d1a",
"id": "CVE-2025-37750-dca998bd",
"digest": {
"function_hash": "321768783408864673461102450089418741419",
"length": 524.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "cifs_crypto_secmech_release",
"file": "fs/smb/client/cifsencrypt.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e859b216d94668bc66330e61be201234f4413d1a",
"id": "CVE-2025-37750-e088a443",
"digest": {
"function_hash": "176691498119242792393306197304516390743",
"length": 1204.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "decrypt_raw_data",
"file": "fs/smb/client/smb2ops.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9502dd5c7029902f4a425bf959917a5a9e7c0e50",
"id": "CVE-2025-37750-e4f6bd78",
"digest": {
"function_hash": "321768783408864673461102450089418741419",
"length": 524.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "cifs_crypto_secmech_release",
"file": "fs/smb/client/cifsencrypt.c"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15",
"id": "CVE-2025-37750-fd5e1b92",
"digest": {
"function_hash": "155519748428286400434329420077476084168",
"length": 6653.0
},
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "SMB2_negotiate",
"file": "fs/smb/client/smb2pdu.c"
},
"signature_type": "Function"
}
]