CVE-2025-38179

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-38179
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38179.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38179
Downstream
Published
2025-07-04T14:15:24Z
Modified
2025-07-10T17:12:15.595236Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix maxsge overflow in smbextractfolioqto_rdma()

This fixes the following problem:

[ 749.901015] [ T8673] run fstests cifs/001 at 2025-06-17 09:40:30 [ 750.346409] [ T9870] ================================================================== [ 750.346814] [ T9870] BUG: KASAN: slab-out-of-bounds in smbsetsge+0x2cc/0x3b0 [cifs] [ 750.347330] [ T9870] Write of size 8 at addr ffff888011082890 by task xfsio/9870 [ 750.347705] [ T9870] [ 750.348077] [ T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfsio Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary) [ 750.348082] [ T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 750.348085] [ T9870] Call Trace: [ 750.348086] [ T9870] <TASK> [ 750.348088] [ T9870] dumpstacklvl+0x76/0xa0 [ 750.348106] [ T9870] printreport+0xd1/0x640 [ 750.348116] [ T9870] ? pfxrawspinlockirqsave+0x10/0x10 [ 750.348120] [ T9870] ? kasancompletemodereportinfo+0x26/0x210 [ 750.348124] [ T9870] kasanreport+0xe7/0x130 [ 750.348128] [ T9870] ? smbsetsge+0x2cc/0x3b0 [cifs] [ 750.348262] [ T9870] ? smbsetsge+0x2cc/0x3b0 [cifs] [ 750.348377] [ T9870] asanreportstore8noabort+0x17/0x30 [ 750.348381] [ T9870] smbsetsge+0x2cc/0x3b0 [cifs] [ 750.348496] [ T9870] smbdpostsenditer+0x1990/0x3070 [cifs] [ 750.348625] [ T9870] ? _pfxsmbdpostsenditer+0x10/0x10 [cifs] [ 750.348741] [ T9870] ? updatestackstate+0x2a0/0x670 [ 750.348749] [ T9870] ? cifsflush+0x153/0x320 [cifs] [ 750.348870] [ T9870] ? cifsflush+0x153/0x320 [cifs] [ 750.348990] [ T9870] ? updatestackstate+0x2a0/0x670 [ 750.348995] [ T9870] smbdsend+0x58c/0x9c0 [cifs] [ 750.349117] [ T9870] ? _pfxsmbdsend+0x10/0x10 [cifs] [ 750.349231] [ T9870] ? unwindgetreturnaddress+0x65/0xb0 [ 750.349235] [ T9870] ? _pfxstacktraceconsumeentry+0x10/0x10 [ 750.349242] [ T9870] ? archstackwalk+0xa7/0x100 [ 750.349250] [ T9870] ? stacktracesave+0x92/0xd0 [ 750.349254] [ T9870] _smbsendrqst+0x931/0xec0 [cifs] [ 750.349374] [ T9870] ? kerneltextaddress+0x173/0x190 [ 750.349379] [ T9870] ? kasansavestack+0x39/0x70 [ 750.349382] [ T9870] ? kasansavetrack+0x18/0x70 [ 750.349385] [ T9870] ? _kasanslaballoc+0x9d/0xa0 [ 750.349389] [ T9870] ? _pfxsmbsendrqst+0x10/0x10 [cifs] [ 750.349508] [ T9870] ? smb2midentryalloc+0xb4/0x7e0 [cifs] [ 750.349626] [ T9870] ? cifscallasync+0x277/0xb00 [cifs] [ 750.349746] [ T9870] ? cifsissuewrite+0x256/0x610 [cifs] [ 750.349867] [ T9870] ? netfsdoissuewrite+0xc2/0x340 [netfs] [ 750.349900] [ T9870] ? netfsadvancewrite+0x45b/0x1270 [netfs] [ 750.349929] [ T9870] ? netfswritefolio+0xd6c/0x1be0 [netfs] [ 750.349958] [ T9870] ? netfswritepages+0x2e9/0xa80 [netfs] [ 750.349987] [ T9870] ? dowritepages+0x21f/0x590 [ 750.349993] [ T9870] ? filemapfdatawritewbc+0xe1/0x140 [ 750.349997] [ T9870] ? entrySYSCALL64afterhwframe+0x76/0x7e [ 750.350002] [ T9870] smbsendrqst+0x22e/0x2f0 [cifs] [ 750.350131] [ T9870] ? pfxsmbsendrqst+0x10/0x10 [cifs] [ 750.350255] [ T9870] ? localclocknoinstr+0xe/0xd0 [ 750.350261] [ T9870] ? kasansaveallocinfo+0x37/0x60 [ 750.350268] [ T9870] ? _kasancheckwrite+0x14/0x30 [ 750.350271] [ T9870] ? _rawspinlock+0x81/0xf0 [ 750.350275] [ T9870] ? _pfxrawspinlock+0x10/0x10 [ 750.350278] [ T9870] ? smb2setupasyncrequest+0x293/0x580 [cifs] [ 750.350398] [ T9870] cifscallasync+0x477/0xb00 [cifs] [ 750.350518] [ T9870] ? pfxsmb2writevcallback+0x10/0x10 [cifs] [ 750.350636] [ T9870] ? _pfxcifscallasync+0x10/0x10 [cifs] [ 750.350756] [ T9870] ? _pfxrawspinlock+0x10/0x10 [ 750.350760] [ T9870] ? _kasancheckwrite+0x14/0x30 [ 750.350763] [ T98 ---truncated---

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.35-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.1.124-1
6.1.128-1
6.1.129-1
6.1.133-1
6.1.135-1
6.1.137-1
6.1.139-1
6.1.140-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1
6.12.5-1
6.12.6-1
6.12.8-1
6.12.9-1~bpo12+1
6.12.9-1
6.12.9-1+alpha
6.12.10-1
6.12.11-1
6.12.11-1+alpha
6.12.11-1+alpha.1
6.12.12-1~bpo12+1
6.12.12-1
6.12.13-1
6.12.15-1
6.12.16-1
6.12.17-1
6.12.19-1
6.12.20-1
6.12.21-1
6.12.22-1~bpo12+1
6.12.22-1
6.12.25-1
6.12.27-1~bpo12+1
6.12.27-1
6.12.29-1
6.12.30-1~bpo12+1
6.12.30-1
6.12.31-1
6.12.32-1~bpo12+1
6.12.32-1
6.12.33-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}