Look up another CVE · open CVE-2025-21673 in the interactive tracker
CVE-2025-21673
smb: client: fix double free of TCP_Server_Info::hostname
Published 2025-01-31 (21 months ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2025-21673 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.11-1 | Update the kernel and reboot. Fixed in 6.12.11-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.12.11-1 | Update the kernel and reboot. Fixed in 6.12.11-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.12.11-1 | Update the kernel and reboot. Fixed in 6.12.11-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When shutting down the server in cifs_put_tcp_session(), cifsd thread might be reconnecting to multiple DFS targets before it realizes it should exit the loop, so @server->hostname can't be freed as long as cifsd thread isn't done. Otherwise the following can happen: RIP: 0010:__slab_free+0x223/0x3c0 Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f> 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80 RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246 RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068 RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400 RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000 R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500 R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068 FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000) 000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4: PKRU: 55555554 Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? __reconnect_target_unlocked+0x3e/0x160 [cifs] ? __die_body.cold+0x8/0xd ? die+0x2b/0x50 ? do_trap+0xce/0x120 ? __slab_free+0x223/0x3c0 ? do_error_trap+0x65/0x80 ? __slab_free+0x223/0x3c0 ? exc_invalid_op+0x4e/0x70 ? __slab_free+0x223/0x3c0 ? asm_exc_invalid_op+0x16/0x20 ? __slab_free+0x223/0x3c0 ? extract_hostname+0x5c/0xa0 [cifs] ? extract_hostname+0x5c/0xa0 [cifs] ? __kmalloc+0x4b/0x140 __reconnect_target_unlocked+0x3e/0x160 [cifs] reconnect_dfs_server+0x145/0x430 [cifs] cifs_handle_standard+0x1ad/0x1d0 [cifs] cifs_demultiplex_thread+0x592/0x730 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0xdd/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 </TASK>
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/client/connect.c
- What this is
- COMMON INTERNET FILE SYSTEM CLIENT (CIFS and SMB3)MAINTAINERS section matched on fs/smb/client/ · linux-cifs@vger.kernel.org · Supported
- Kernel module
- cifs
Check it on the machine
grep -wE 'CONFIG_CIFS|CONFIG_SMBFS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cifsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_CIFS, CONFIG_SMBFS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2025-01-31 (21 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.41%, higher than 33.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.16 | 6.6.74 | 1ea680703385 |
| 5.16 | 6.12.11 | a2be5f2ba34d |
| 5.16 | 6.13 | fa2f9906a7b3 |
| 5.14.19 | 0 | 0 |
| 5.15.3 | 0 | 0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug lives in the SMB client's connection/reconnect handling, which processes data from the remote peer — the remote server controls when the TCP connection drops (forcing reconnect) and controls the DFS referral target list that drives the offending free loop. A compromised/malicious SMB-DFS file server, or an on-path attacker able to reset connections and inject referrals, reaches this over the network.
- AC:LAttack complexity, low
- The attacker controls both sides of the race and the window size: it forces reconnects at will, supplies an arbitrarily long DFS target list, and can point targets at blackholed addresses so each `generic_ip_connect()` blocks for the TCP SYN-retry timeout (~130s) while `msleep(3000)` adds more, and the per-target loop never re-checks `tcpStatus`. The race can be retried unboundedly on every reconnect cycle, and it was hit in real-world operation.
- PR:NPrivileges required, none
- The attacking SMB server holds no privileges on the victim client, and the vulnerable `__reconnect_target_unlocked()` path executes during socket reconnect, before SMB negotiate/session-setup — i.e. pre-authentication. The teardown side is likewise reachable via timer/workqueue-driven paths (`smb2_reconnect_server`, automount expiry) requiring no local privileges.
- UI:NUser interaction, none
- For an already-mounted DFS share (fstab/autofs, the normal enterprise deployment), reconnect, referral failover, and automount expiry are entirely server- and timer-driven, so no victim action occurs during the attack. The existing mount is a precondition of the deployment, not an in-attack user step.
- S:UScope, unchanged
- The double free corrupts the kernel slab allocator and impacts only kernel-managed resources within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- A double free lets the same slab object be handed to two allocation sites, yielding type confusion and an arbitrary-read primitive. Additionally there is a direct leak: `reconn_set_ipaddr_from_hostname()` formats the freed string into a UNC and passes it to the `dns_query()` userspace upcall, exfiltrating reused kernel heap contents to userspace verbatim.
- I:HIntegrity impact, high
- Double free is a classic heap-corruption primitive — freelist manipulation via heap spraying gives a controlled write and enables control-flow hijacking and privilege escalation. The freed object is a small attacker-influenced `kmalloc` string in a heavily-used general-purpose cache, making reclaim straightforward.
- A:HAvailability impact, high
- The reported effect is an immediate slab consistency BUG (`__slab_free` invalid-op) killing the cifsd kthread, and a panic under `panic_on_oops`. Even unexploited, the allocator corruption reliably destabilizes or crashes the whole system.