GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38179 (GCVE-0-2025-38179)

Vulnerability from cvelistv5 – Published: 2025-07-04 13:37 – Updated: 2026-08-05 12:00
VLAI
Title
smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() This fixes the following problem: [ 749.901015] [ T8673] run fstests cifs/001 at 2025-06-17 09:40:30 [ 750.346409] [ T9870] ================================================================== [ 750.346814] [ T9870] BUG: KASAN: slab-out-of-bounds in smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.347330] [ T9870] Write of size 8 at addr ffff888011082890 by task xfs_io/9870 [ 750.347705] [ T9870] [ 750.348077] [ T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary) [ 750.348082] [ T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 750.348085] [ T9870] Call Trace: [ 750.348086] [ T9870] <TASK> [ 750.348088] [ T9870] dump_stack_lvl+0x76/0xa0 [ 750.348106] [ T9870] print_report+0xd1/0x640 [ 750.348116] [ T9870] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 750.348120] [ T9870] ? kasan_complete_mode_report_info+0x26/0x210 [ 750.348124] [ T9870] kasan_report+0xe7/0x130 [ 750.348128] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348262] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348377] [ T9870] __asan_report_store8_noabort+0x17/0x30 [ 750.348381] [ T9870] smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348496] [ T9870] smbd_post_send_iter+0x1990/0x3070 [cifs] [ 750.348625] [ T9870] ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs] [ 750.348741] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348749] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348870] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348990] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348995] [ T9870] smbd_send+0x58c/0x9c0 [cifs] [ 750.349117] [ T9870] ? __pfx_smbd_send+0x10/0x10 [cifs] [ 750.349231] [ T9870] ? unwind_get_return_address+0x65/0xb0 [ 750.349235] [ T9870] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 750.349242] [ T9870] ? arch_stack_walk+0xa7/0x100 [ 750.349250] [ T9870] ? stack_trace_save+0x92/0xd0 [ 750.349254] [ T9870] __smb_send_rqst+0x931/0xec0 [cifs] [ 750.349374] [ T9870] ? kernel_text_address+0x173/0x190 [ 750.349379] [ T9870] ? kasan_save_stack+0x39/0x70 [ 750.349382] [ T9870] ? kasan_save_track+0x18/0x70 [ 750.349385] [ T9870] ? __kasan_slab_alloc+0x9d/0xa0 [ 750.349389] [ T9870] ? __pfx___smb_send_rqst+0x10/0x10 [cifs] [ 750.349508] [ T9870] ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs] [ 750.349626] [ T9870] ? cifs_call_async+0x277/0xb00 [cifs] [ 750.349746] [ T9870] ? cifs_issue_write+0x256/0x610 [cifs] [ 750.349867] [ T9870] ? netfs_do_issue_write+0xc2/0x340 [netfs] [ 750.349900] [ T9870] ? netfs_advance_write+0x45b/0x1270 [netfs] [ 750.349929] [ T9870] ? netfs_write_folio+0xd6c/0x1be0 [netfs] [ 750.349958] [ T9870] ? netfs_writepages+0x2e9/0xa80 [netfs] [ 750.349987] [ T9870] ? do_writepages+0x21f/0x590 [ 750.349993] [ T9870] ? filemap_fdatawrite_wbc+0xe1/0x140 [ 750.349997] [ T9870] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.350002] [ T9870] smb_send_rqst+0x22e/0x2f0 [cifs] [ 750.350131] [ T9870] ? __pfx_smb_send_rqst+0x10/0x10 [cifs] [ 750.350255] [ T9870] ? local_clock_noinstr+0xe/0xd0 [ 750.350261] [ T9870] ? kasan_save_alloc_info+0x37/0x60 [ 750.350268] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350271] [ T9870] ? _raw_spin_lock+0x81/0xf0 [ 750.350275] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350278] [ T9870] ? smb2_setup_async_request+0x293/0x580 [cifs] [ 750.350398] [ T9870] cifs_call_async+0x477/0xb00 [cifs] [ 750.350518] [ T9870] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [ 750.350636] [ T9870] ? __pfx_cifs_call_async+0x10/0x10 [cifs] [ 750.350756] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350760] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350763] [ T98 ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c45ebd636c32d33c75e51ce977520ff146bd41a1 , < 8ae7814589d7bd850294ac14ec4c1725dafd42ca (git)
Affected: c45ebd636c32d33c75e51ce977520ff146bd41a1 , < e0ba9b2f188166550296005e64b15e80db82ad8a (git)
Affected: c45ebd636c32d33c75e51ce977520ff146bd41a1 , < a379a8a2a0032e12e7ef397197c9c2ad011588d6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smbdirect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8ae7814589d7bd850294ac14ec4c1725dafd42ca",
              "status": "affected",
              "version": "c45ebd636c32d33c75e51ce977520ff146bd41a1",
              "versionType": "git"
            },
            {
              "lessThan": "e0ba9b2f188166550296005e64b15e80db82ad8a",
              "status": "affected",
              "version": "c45ebd636c32d33c75e51ce977520ff146bd41a1",
              "versionType": "git"
            },
            {
              "lessThan": "a379a8a2a0032e12e7ef397197c9c2ad011588d6",
              "status": "affected",
              "version": "c45ebd636c32d33c75e51ce977520ff146bd41a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smbdirect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()\n\nThis fixes the following problem:\n\n[  749.901015] [   T8673] run fstests cifs/001 at 2025-06-17 09:40:30\n[  750.346409] [   T9870] ==================================================================\n[  750.346814] [   T9870] BUG: KASAN: slab-out-of-bounds in smb_set_sge+0x2cc/0x3b0 [cifs]\n[  750.347330] [   T9870] Write of size 8 at addr ffff888011082890 by task xfs_io/9870\n[  750.347705] [   T9870]\n[  750.348077] [   T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary)\n[  750.348082] [   T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\n[  750.348085] [   T9870] Call Trace:\n[  750.348086] [   T9870]  \u003cTASK\u003e\n[  750.348088] [   T9870]  dump_stack_lvl+0x76/0xa0\n[  750.348106] [   T9870]  print_report+0xd1/0x640\n[  750.348116] [   T9870]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[  750.348120] [   T9870]  ? kasan_complete_mode_report_info+0x26/0x210\n[  750.348124] [   T9870]  kasan_report+0xe7/0x130\n[  750.348128] [   T9870]  ? smb_set_sge+0x2cc/0x3b0 [cifs]\n[  750.348262] [   T9870]  ? smb_set_sge+0x2cc/0x3b0 [cifs]\n[  750.348377] [   T9870]  __asan_report_store8_noabort+0x17/0x30\n[  750.348381] [   T9870]  smb_set_sge+0x2cc/0x3b0 [cifs]\n[  750.348496] [   T9870]  smbd_post_send_iter+0x1990/0x3070 [cifs]\n[  750.348625] [   T9870]  ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs]\n[  750.348741] [   T9870]  ? update_stack_state+0x2a0/0x670\n[  750.348749] [   T9870]  ? cifs_flush+0x153/0x320 [cifs]\n[  750.348870] [   T9870]  ? cifs_flush+0x153/0x320 [cifs]\n[  750.348990] [   T9870]  ? update_stack_state+0x2a0/0x670\n[  750.348995] [   T9870]  smbd_send+0x58c/0x9c0 [cifs]\n[  750.349117] [   T9870]  ? __pfx_smbd_send+0x10/0x10 [cifs]\n[  750.349231] [   T9870]  ? unwind_get_return_address+0x65/0xb0\n[  750.349235] [   T9870]  ? __pfx_stack_trace_consume_entry+0x10/0x10\n[  750.349242] [   T9870]  ? arch_stack_walk+0xa7/0x100\n[  750.349250] [   T9870]  ? stack_trace_save+0x92/0xd0\n[  750.349254] [   T9870]  __smb_send_rqst+0x931/0xec0 [cifs]\n[  750.349374] [   T9870]  ? kernel_text_address+0x173/0x190\n[  750.349379] [   T9870]  ? kasan_save_stack+0x39/0x70\n[  750.349382] [   T9870]  ? kasan_save_track+0x18/0x70\n[  750.349385] [   T9870]  ? __kasan_slab_alloc+0x9d/0xa0\n[  750.349389] [   T9870]  ? __pfx___smb_send_rqst+0x10/0x10 [cifs]\n[  750.349508] [   T9870]  ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs]\n[  750.349626] [   T9870]  ? cifs_call_async+0x277/0xb00 [cifs]\n[  750.349746] [   T9870]  ? cifs_issue_write+0x256/0x610 [cifs]\n[  750.349867] [   T9870]  ? netfs_do_issue_write+0xc2/0x340 [netfs]\n[  750.349900] [   T9870]  ? netfs_advance_write+0x45b/0x1270 [netfs]\n[  750.349929] [   T9870]  ? netfs_write_folio+0xd6c/0x1be0 [netfs]\n[  750.349958] [   T9870]  ? netfs_writepages+0x2e9/0xa80 [netfs]\n[  750.349987] [   T9870]  ? do_writepages+0x21f/0x590\n[  750.349993] [   T9870]  ? filemap_fdatawrite_wbc+0xe1/0x140\n[  750.349997] [   T9870]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  750.350002] [   T9870]  smb_send_rqst+0x22e/0x2f0 [cifs]\n[  750.350131] [   T9870]  ? __pfx_smb_send_rqst+0x10/0x10 [cifs]\n[  750.350255] [   T9870]  ? local_clock_noinstr+0xe/0xd0\n[  750.350261] [   T9870]  ? kasan_save_alloc_info+0x37/0x60\n[  750.350268] [   T9870]  ? __kasan_check_write+0x14/0x30\n[  750.350271] [   T9870]  ? _raw_spin_lock+0x81/0xf0\n[  750.350275] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10\n[  750.350278] [   T9870]  ? smb2_setup_async_request+0x293/0x580 [cifs]\n[  750.350398] [   T9870]  cifs_call_async+0x477/0xb00 [cifs]\n[  750.350518] [   T9870]  ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]\n[  750.350636] [   T9870]  ? __pfx_cifs_call_async+0x10/0x10 [cifs]\n[  750.350756] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10\n[  750.350760] [   T9870]  ? __kasan_check_write+0x14/0x30\n[  750.350763] [   T98\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is driven entirely by local file I/O \u2014 a `write()`/`mmap` plus writeback/flush on an already-mounted SMB Direct share \u2014 and the corrupting data comes from the local page-cache folio queue, not from any remote peer\u0027s input. No network-supplied data is parsed on this path, so it is locally reachable only.\nAC:L - On a cifs `rdma` mount the loop bound is broken unconditionally, so every writeback whose rolling buffer holds more than five folios overflows \u2014 it reproduces on a stock fstests run with no race, no heap grooming and no state outside the attacker\u0027s control. The attacker fully controls write size and pattern, and thus the number of out-of-bounds SGEs written.\nPR:L - Any unprivileged local user with write access to a file on the SMB Direct mount can trigger it; no capability, root, or namespace trickery is required. The mount itself is an environmental precondition of the vulnerable configuration, not a privilege the attacker must hold.\nUI:N - The attacker performs the write and flush themselves \u2014 writeback also fires automatically \u2014 so no action by any other user is needed once the share is mounted.\nS:U - The out-of-bounds write and the resulting corruption are confined to kernel heap managed by the same security authority; the SGEs handed to the RDMA device use legitimately mapped DMA addresses, so no IOMMU or virtualization boundary is crossed.\nC:H - Beyond the heap corruption itself giving read primitives, the inflated `request-\u003enum_sge` is passed straight to `ib_post_send()`, so the RDMA NIC gathers from out-of-bounds `ib_sge` entries and transmits that arbitrary kernel memory to the remote SMB server \u2014 a direct disclosure channel.\nI:H - This is an unbounded slab out-of-bounds write that scribbled ~126 KB past a 144-byte `smbd_request` in the reported trace, overwriting adjacent slab objects with 16-byte `{dma_addr, length, lkey}` records whose lengths the attacker influences via write sizes \u2014 classic heap-spray territory for control-flow hijacking.\nA:H - The reported trace ends in a kernel Oops (\"unable to handle page fault for address ffff8880110a2000\", supervisor write, `Oops: 0003 [#1] SMP`) after the overflow runs off the end of mapped memory, and the corrupted `iter-\u003ecount` underflow plus wild `ib_dma_unmap_single()` calls guarantee further instability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:09.584Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8ae7814589d7bd850294ac14ec4c1725dafd42ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0ba9b2f188166550296005e64b15e80db82ad8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a379a8a2a0032e12e7ef397197c9c2ad011588d6"
        }
      ],
      "title": "smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38179",
    "datePublished": "2025-07-04T13:37:07.383Z",
    "dateReserved": "2025-04-16T04:51:23.992Z",
    "dateUpdated": "2026-08-05T12:00:09.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38179",
      "date": "2026-09-19",
      "epss": "0.00163",
      "percentile": "0.05912"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smbdirect.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8ae7814589d7bd850294ac14ec4c1725dafd42ca",
                    "status": "affected",
                    "version": "c45ebd636c32d33c75e51ce977520ff146bd41a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e0ba9b2f188166550296005e64b15e80db82ad8a",
                    "status": "affected",
                    "version": "c45ebd636c32d33c75e51ce977520ff146bd41a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a379a8a2a0032e12e7ef397197c9c2ad011588d6",
                    "status": "affected",
                    "version": "c45ebd636c32d33c75e51ce977520ff146bd41a1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smbdirect.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B9A5A6B0-4B32-4F26-8142-EF867203ADBB",
                    "versionEndExcluding": "6.12.35",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655",
                    "versionEndExcluding": "6.15.4",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()\n\nThis fixes the following problem:\n\n[  749.901015] [   T8673] run fstests cifs/001 at 2025-06-17 09:40:30\n[  750.346409] [   T9870] ==================================================================\n[  750.346814] [   T9870] BUG: KASAN: slab-out-of-bounds in smb_set_sge+0x2cc/0x3b0 [cifs]\n[  750.347330] [   T9870] Write of size 8 at addr ffff888011082890 by task xfs_io/9870\n[  750.347705] [   T9870]\n[  750.348077] [   T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary)\n[  750.348082] [   T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\n[  750.348085] [   T9870] Call Trace:\n[  750.348086] [   T9870]  \u003cTASK\u003e\n[  750.348088] [   T9870]  dump_stack_lvl+0x76/0xa0\n[  750.348106] [   T9870]  print_report+0xd1/0x640\n[  750.348116] [   T9870]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[  750.348120] [   T9870]  ? kasan_complete_mode_report_info+0x26/0x210\n[  750.348124] [   T9870]  kasan_report+0xe7/0x130\n[  750.348128] [   T9870]  ? smb_set_sge+0x2cc/0x3b0 [cifs]\n[  750.348262] [   T9870]  ? smb_set_sge+0x2cc/0x3b0 [cifs]\n[  750.348377] [   T9870]  __asan_report_store8_noabort+0x17/0x30\n[  750.348381] [   T9870]  smb_set_sge+0x2cc/0x3b0 [cifs]\n[  750.348496] [   T9870]  smbd_post_send_iter+0x1990/0x3070 [cifs]\n[  750.348625] [   T9870]  ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs]\n[  750.348741] [   T9870]  ? update_stack_state+0x2a0/0x670\n[  750.348749] [   T9870]  ? cifs_flush+0x153/0x320 [cifs]\n[  750.348870] [   T9870]  ? cifs_flush+0x153/0x320 [cifs]\n[  750.348990] [   T9870]  ? update_stack_state+0x2a0/0x670\n[  750.348995] [   T9870]  smbd_send+0x58c/0x9c0 [cifs]\n[  750.349117] [   T9870]  ? __pfx_smbd_send+0x10/0x10 [cifs]\n[  750.349231] [   T9870]  ? unwind_get_return_address+0x65/0xb0\n[  750.349235] [   T9870]  ? __pfx_stack_trace_consume_entry+0x10/0x10\n[  750.349242] [   T9870]  ? arch_stack_walk+0xa7/0x100\n[  750.349250] [   T9870]  ? stack_trace_save+0x92/0xd0\n[  750.349254] [   T9870]  __smb_send_rqst+0x931/0xec0 [cifs]\n[  750.349374] [   T9870]  ? kernel_text_address+0x173/0x190\n[  750.349379] [   T9870]  ? kasan_save_stack+0x39/0x70\n[  750.349382] [   T9870]  ? kasan_save_track+0x18/0x70\n[  750.349385] [   T9870]  ? __kasan_slab_alloc+0x9d/0xa0\n[  750.349389] [   T9870]  ? __pfx___smb_send_rqst+0x10/0x10 [cifs]\n[  750.349508] [   T9870]  ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs]\n[  750.349626] [   T9870]  ? cifs_call_async+0x277/0xb00 [cifs]\n[  750.349746] [   T9870]  ? cifs_issue_write+0x256/0x610 [cifs]\n[  750.349867] [   T9870]  ? netfs_do_issue_write+0xc2/0x340 [netfs]\n[  750.349900] [   T9870]  ? netfs_advance_write+0x45b/0x1270 [netfs]\n[  750.349929] [   T9870]  ? netfs_write_folio+0xd6c/0x1be0 [netfs]\n[  750.349958] [   T9870]  ? netfs_writepages+0x2e9/0xa80 [netfs]\n[  750.349987] [   T9870]  ? do_writepages+0x21f/0x590\n[  750.349993] [   T9870]  ? filemap_fdatawrite_wbc+0xe1/0x140\n[  750.349997] [   T9870]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  750.350002] [   T9870]  smb_send_rqst+0x22e/0x2f0 [cifs]\n[  750.350131] [   T9870]  ? __pfx_smb_send_rqst+0x10/0x10 [cifs]\n[  750.350255] [   T9870]  ? local_clock_noinstr+0xe/0xd0\n[  750.350261] [   T9870]  ? kasan_save_alloc_info+0x37/0x60\n[  750.350268] [   T9870]  ? __kasan_check_write+0x14/0x30\n[  750.350271] [   T9870]  ? _raw_spin_lock+0x81/0xf0\n[  750.350275] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10\n[  750.350278] [   T9870]  ? smb2_setup_async_request+0x293/0x580 [cifs]\n[  750.350398] [   T9870]  cifs_call_async+0x477/0xb00 [cifs]\n[  750.350518] [   T9870]  ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]\n[  750.350636] [   T9870]  ? __pfx_cifs_call_async+0x10/0x10 [cifs]\n[  750.350756] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10\n[  750.350760] [   T9870]  ? __kasan_check_write+0x14/0x30\n[  750.350763] [   T98\n---truncated---"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: corregir desbordamiento de max_sge en smb_extract_folioq_to_rdma() Esto corrige el siguiente problema: [ 749.901015] [ T8673] ejecutar fstests cifs/001 a las 2025-06-17 09:40:30 [ 750.346409] [ T9870] ====================================================================== [ 750.346814] [ T9870] ERROR: KASAN: slab-out-of-bounds in smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.347330] [ T9870] Write of size 8 at addr ffff888011082890 by task xfs_io/9870 [ 750.347705] [ T9870] [ 750.348077] [ T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary) [ 750.348082] [ T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 750.348085] [ T9870] Call Trace: [ 750.348086] [ T9870]  [ 750.348088] [ T9870] dump_stack_lvl+0x76/0xa0 [ 750.348106] [ T9870] print_report+0xd1/0x640 [ 750.348116] [ T9870] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 750.348120] [ T9870] ? kasan_complete_mode_report_info+0x26/0x210 [ 750.348124] [ T9870] kasan_report+0xe7/0x130 [ 750.348128] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348262] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348377] [ T9870] __asan_report_store8_noabort+0x17/0x30 [ 750.348381] [ T9870] smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348496] [ T9870] smbd_post_send_iter+0x1990/0x3070 [cifs] [ 750.348625] [ T9870] ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs] [ 750.348741] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348749] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348870] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348990] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348995] [ T9870] smbd_send+0x58c/0x9c0 [cifs] [ 750.349117] [ T9870] ? __pfx_smbd_send+0x10/0x10 [cifs] [ 750.349231] [ T9870] ? unwind_get_return_address+0x65/0xb0 [ 750.349235] [ T9870] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 750.349242] [ T9870] ? arch_stack_walk+0xa7/0x100 [ 750.349250] [ T9870] ? stack_trace_save+0x92/0xd0 [ 750.349254] [ T9870] __smb_send_rqst+0x931/0xec0 [cifs] [ 750.349374] [ T9870] ? kernel_text_address+0x173/0x190 [ 750.349379] [ T9870] ? kasan_save_stack+0x39/0x70 [ 750.349382] [ T9870] ? kasan_save_track+0x18/0x70 [ 750.349385] [ T9870] ? __kasan_slab_alloc+0x9d/0xa0 [ 750.349389] [ T9870] ? __pfx___smb_send_rqst+0x10/0x10 [cifs] [ 750.349508] [ T9870] ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs] [ 750.349626] [ T9870] ? cifs_call_async+0x277/0xb00 [cifs] [ 750.349746] [ T9870] ? cifs_issue_write+0x256/0x610 [cifs] [ 750.349867] [ T9870] ? netfs_do_issue_write+0xc2/0x340 [netfs] [ 750.349900] [ T9870] ? netfs_advance_write+0x45b/0x1270 [netfs] [ 750.349929] [ T9870] ? netfs_write_folio+0xd6c/0x1be0 [netfs] [ 750.349958] [ T9870] ? netfs_writepages+0x2e9/0xa80 [netfs] [ 750.349987] [ T9870] ? do_writepages+0x21f/0x590 [ 750.349993] [ T9870] ? filemap_fdatawrite_wbc+0xe1/0x140 [ 750.349997] [ T9870] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.350002] [ T9870] smb_send_rqst+0x22e/0x2f0 [cifs] [ 750.350131] [ T9870] ? __pfx_smb_send_rqst+0x10/0x10 [cifs] [ 750.350255] [ T9870] ? local_clock_noinstr+0xe/0xd0 [ 750.350261] [ T9870] ? kasan_save_alloc_info+0x37/0x60 [ 750.350268] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350271] [ T9870] ? _raw_spin_lock+0x81/0xf0 [ 750.350275] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350278] [ T9870] ? smb2_setup_async_request+0x293/0x580 [cifs] [ 750.350398] [ T9870] cifs_call_async+0x477/0xb00 [cifs] [ 750.350518] [ T9870] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [ 750.350636] [ T9870] ? __pfx_cifs_call_async+0x10/0x10 [cifs] [ 750.350756] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350760] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350763] [ T98 ---truncado---"
          }
        ],
        "id": "CVE-2025-38179",
        "lastModified": "2026-07-30T06:22:57.910",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-04T14:15:24.553",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8ae7814589d7bd850294ac14ec4c1725dafd42ca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a379a8a2a0032e12e7ef397197c9c2ad011588d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e0ba9b2f188166550296005e64b15e80db82ad8a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:09:06+00:00",
      "cve": "CVE-2025-38179",
      "id": "CVE-2025-38179",
      "initial_release_date": "2025-07-04T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38179.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:16:53Z",
      "cve": "CVE-2025-38179",
      "id": "CVE-2025-38179",
      "initial_release_date": "2025-07-04T23:22:19Z",
      "product_status:known_not_affected": "524",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38179",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38179.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.