CVE-2025-38379 (GCVE-0-2025-38379)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01
VLAI
Title
smb: client: fix warning when reconnecting channel
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning when reconnecting channel When reconnecting a channel in smb2_reconnect_server(), a dummy tcon is passed down to smb2_reconnect() with ->query_interface uninitialized, so we can't call queue_delayed_work() on it. Fix the following warning by ensuring that we're queueing the delayed worker from correct tcon. WARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200 Modules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__queue_delayed_work+0x1d2/0x200 Code: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00 00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f> 0b 90 e9 65 fe ff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9 RSP: 0018:ffffc900014afad8 EFLAGS: 00010003 RAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1 RDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0 RBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331 R10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040 R13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020 FS: 0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> queue_delayed_work_on+0xb4/0xc0 smb2_reconnect+0xb22/0xf50 [cifs] smb2_reconnect_server+0x413/0xd40 [cifs] ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs] ? local_clock_noinstr+0xd/0xd0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 process_one_work+0x4c5/0xa10 ? __pfx_process_one_work+0x10/0x10 ? __list_add_valid_or_report+0x37/0x120 worker_thread+0x2f1/0x5a0 ? __kthread_parkme+0xde/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x1f0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x15b/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 1116206 hardirqs last enabled at (1116205): [<ffffffff8143af42>] __up_console_sem+0x52/0x60 hardirqs last disabled at (1116206): [<ffffffff81399f0e>] queue_delayed_work_on+0x6e/0xc0 softirqs last enabled at (1116138): [<ffffffffc04562fd>] __smb_send_rqst+0x42d/0x950 [cifs] softirqs last disabled at (1116136): [<ffffffff823d35e1>] release_sock+0x21/0xf0
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 202d7e838967dda02855cd925db7fd8c52c56af7 , < 0cee638d92ac898d73eccc4e4bab70e9fc95946a (git)
Affected: 2c34f1e095a12be3674fb79d84d1af7896e49245 , < 3f6932ef25378794894c3c1024092ad14da2d330 (git)
Affected: 4f81ee0af2b8c4089e308f7cb6b5ea5a4efe5b94 , < 9d2b629a9dc5c72537645533af1cb11a7d34c4b1 (git)
Affected: 42ca547b13a20e7cbb04fbdf8d5f089ac4bb35b7 , < 3bbe46716092d8ef6b0df4b956f585c5cd0fc78e (git)
Create a notification for this product.
Linux Linux Affected: 6.6.95 , < 6.6.97 (semver)
Affected: 6.12.35 , < 6.12.37 (semver)
Affected: 6.15.4 , < 6.15.6 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsglob.h",
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0cee638d92ac898d73eccc4e4bab70e9fc95946a",
              "status": "affected",
              "version": "202d7e838967dda02855cd925db7fd8c52c56af7",
              "versionType": "git"
            },
            {
              "lessThan": "3f6932ef25378794894c3c1024092ad14da2d330",
              "status": "affected",
              "version": "2c34f1e095a12be3674fb79d84d1af7896e49245",
              "versionType": "git"
            },
            {
              "lessThan": "9d2b629a9dc5c72537645533af1cb11a7d34c4b1",
              "status": "affected",
              "version": "4f81ee0af2b8c4089e308f7cb6b5ea5a4efe5b94",
              "versionType": "git"
            },
            {
              "lessThan": "3bbe46716092d8ef6b0df4b956f585c5cd0fc78e",
              "status": "affected",
              "version": "42ca547b13a20e7cbb04fbdf8d5f089ac4bb35b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsglob.h",
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.97",
              "status": "affected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.37",
              "status": "affected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15.6",
              "status": "affected",
              "version": "6.15.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "6.6.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.12.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.15.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix warning when reconnecting channel\n\nWhen reconnecting a channel in smb2_reconnect_server(), a dummy tcon\nis passed down to smb2_reconnect() with -\u003equery_interface\nuninitialized, so we can\u0027t call queue_delayed_work() on it.\n\nFix the following warning by ensuring that we\u0027re queueing the delayed\nworker from correct tcon.\n\nWARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200\nModules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\nCPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014\nWorkqueue: cifsiod smb2_reconnect_server [cifs]\nRIP: 0010:__queue_delayed_work+0x1d2/0x200\nCode: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00\n00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f\u003e 0b 90 e9 65 fe\nff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9\nRSP: 0018:ffffc900014afad8 EFLAGS: 00010003\nRAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1\nRDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0\nRBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331\nR10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040\nR13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020\nFS:  0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n queue_delayed_work_on+0xb4/0xc0\n smb2_reconnect+0xb22/0xf50 [cifs]\n smb2_reconnect_server+0x413/0xd40 [cifs]\n ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs]\n ? local_clock_noinstr+0xd/0xd0\n ? local_clock+0x15/0x30\n ? lock_release+0x29b/0x390\n process_one_work+0x4c5/0xa10\n ? __pfx_process_one_work+0x10/0x10\n ? __list_add_valid_or_report+0x37/0x120\n worker_thread+0x2f1/0x5a0\n ? __kthread_parkme+0xde/0x100\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1fe/0x380\n ? kthread+0x10f/0x380\n ? __pfx_kthread+0x10/0x10\n ? local_clock_noinstr+0xd/0xd0\n ? ret_from_fork+0x1b/0x1f0\n ? local_clock+0x15/0x30\n ? lock_release+0x29b/0x390\n ? rcu_is_watching+0x20/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x15b/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\nirq event stamp: 1116206\nhardirqs last  enabled at (1116205): [\u003cffffffff8143af42\u003e] __up_console_sem+0x52/0x60\nhardirqs last disabled at (1116206): [\u003cffffffff81399f0e\u003e] queue_delayed_work_on+0x6e/0xc0\nsoftirqs last  enabled at (1116138): [\u003cffffffffc04562fd\u003e] __smb_send_rqst+0x42d/0x950 [cifs]\nsoftirqs last disabled at (1116136): [\u003cffffffff823d35e1\u003e] release_sock+0x21/0xf0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The faulty path is driven entirely by a remote SMB server over TCP/445 \u2014 the server sets `SMB2_GLOBAL_CAP_MULTI_CHANNEL` in its NEGOTIATE response and drops the connection to force `smb2_reconnect_server()` to run. An off-path attacker able to inject TCP resets against an existing mount can equally force the reconnect.\nAC:L - Both preconditions are attacker-controlled and deterministic: advertise the multichannel capability bit, then close the TCP connection. The IPC tcon always has an uninitialized `query_interfaces` worker, so the WARN is hit on the first reconnect with no race or memory-layout dependency.\nPR:N - The attacker is the remote SMB server (or a malicious/compromised server the client connects to) and holds no credentials or privileges on the victim system; the capability advertisement is read from the unauthenticated NEGOTIATE response and the reconnect path is reached before any per-request authorization on the client.\nUI:N - The share is already mounted as a standing configuration (fstab/automount/persistent mount), and the trigger is a server-initiated disconnect handled by the `cifsiod` workqueue. No action by a local user is required at attack time.\nS:U - The fault is confined to the cifs client\u0027s own workqueue/timer bookkeeping inside the kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - No memory is read out of bounds and no freed object is reused \u2014 the timer is rejected by the `!timer-\u003efunction` shutdown guard before enqueue. The only output is a WARN backtrace to the privileged kernel log, which the remote attacker cannot read.\nI:N - The only writes are to fields inside the tcon\u0027s own embedded `delayed_work` (`dwork-\u003ewq`, `dwork-\u003ecpu`, `timer-\u003eexpires`) and the `WORK_STRUCT_PENDING` bit; nothing is written out of bounds or to freed memory, so no kernel data or control flow can be modified.\nA:H - A remote server reliably triggers a kernel WARN/oops splat at `kernel/workqueue.c:2498`, tainting the kernel \u2014 and on the many deployments booted with `panic_on_warn` (Android, ChromeOS, hardened cloud fleets) this is an immediate remote kernel panic. It additionally leaves the work item permanently marked PENDING, breaking multichannel interface polling for that connection."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:28.794Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0cee638d92ac898d73eccc4e4bab70e9fc95946a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f6932ef25378794894c3c1024092ad14da2d330"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d2b629a9dc5c72537645533af1cb11a7d34c4b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bbe46716092d8ef6b0df4b956f585c5cd0fc78e"
        }
      ],
      "title": "smb: client: fix warning when reconnecting channel",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38379",
    "datePublished": "2025-07-25T12:53:21.098Z",
    "dateReserved": "2025-04-16T04:51:24.010Z",
    "dateUpdated": "2026-08-05T12:01:28.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38379",
      "date": "2026-08-05",
      "epss": "0.00338",
      "percentile": "0.26379"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-03T22:56:14.000Z",
      "cve": "CVE-2025-38379",
      "id": "msrc_CVE-2025-38379",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix warning when reconnecting channel",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38379.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38379\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:27.033\",\"lastModified\":\"2026-07-30T06:23:11.227\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix warning when reconnecting channel\\n\\nWhen reconnecting a channel in smb2_reconnect_server(), a dummy tcon\\nis passed down to smb2_reconnect() with -\u003equery_interface\\nuninitialized, so we can\u0027t call queue_delayed_work() on it.\\n\\nFix the following warning by ensuring that we\u0027re queueing the delayed\\nworker from correct tcon.\\n\\nWARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200\\nModules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\\nCPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary)\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014\\nWorkqueue: cifsiod smb2_reconnect_server [cifs]\\nRIP: 0010:__queue_delayed_work+0x1d2/0x200\\nCode: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00\\n00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f\u003e 0b 90 e9 65 fe\\nff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9\\nRSP: 0018:ffffc900014afad8 EFLAGS: 00010003\\nRAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1\\nRDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0\\nRBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331\\nR10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040\\nR13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020\\nFS:  0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0\\nPKRU: 55555554\\nCall Trace:\\n \u003cTASK\u003e\\n queue_delayed_work_on+0xb4/0xc0\\n smb2_reconnect+0xb22/0xf50 [cifs]\\n smb2_reconnect_server+0x413/0xd40 [cifs]\\n ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs]\\n ? local_clock_noinstr+0xd/0xd0\\n ? local_clock+0x15/0x30\\n ? lock_release+0x29b/0x390\\n process_one_work+0x4c5/0xa10\\n ? __pfx_process_one_work+0x10/0x10\\n ? __list_add_valid_or_report+0x37/0x120\\n worker_thread+0x2f1/0x5a0\\n ? __kthread_parkme+0xde/0x100\\n ? __pfx_worker_thread+0x10/0x10\\n kthread+0x1fe/0x380\\n ? kthread+0x10f/0x380\\n ? __pfx_kthread+0x10/0x10\\n ? local_clock_noinstr+0xd/0xd0\\n ? ret_from_fork+0x1b/0x1f0\\n ? local_clock+0x15/0x30\\n ? lock_release+0x29b/0x390\\n ? rcu_is_watching+0x20/0x50\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x15b/0x1f0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\nirq event stamp: 1116206\\nhardirqs last  enabled at (1116205): [\u003cffffffff8143af42\u003e] __up_console_sem+0x52/0x60\\nhardirqs last disabled at (1116206): [\u003cffffffff81399f0e\u003e] queue_delayed_work_on+0x6e/0xc0\\nsoftirqs last  enabled at (1116138): [\u003cffffffffc04562fd\u003e] __smb_send_rqst+0x42d/0x950 [cifs]\\nsoftirqs last disabled at (1116136): [\u003cffffffff823d35e1\u003e] release_sock+0x21/0xf0\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: se corrige la advertencia al reconectar el canal. Al reconectar un canal en smb2_reconnect_server(), se pasa una transacci\u00f3n ficticia a smb2_reconnect() con -\u0026gt;query_interface sin inicializar, por lo que no se puede ejecutar queue_delayed_work() en ella. Corrija la siguiente advertencia asegur\u00e1ndose de que se est\u00e9 poniendo en cola el trabajador retrasado desde la transacci\u00f3n correcta. WARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200 Modules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__queue_delayed_work+0x1d2/0x200 Code: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00 00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f\u0026gt; 0b 90 e9 65 fe ff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9 RSP: 0018:ffffc900014afad8 EFLAGS: 00010003 RAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1 RDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0 RBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331 R10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040 R13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020 FS: 0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace:  queue_delayed_work_on+0xb4/0xc0 smb2_reconnect+0xb22/0xf50 [cifs] smb2_reconnect_server+0x413/0xd40 [cifs] ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs] ? local_clock_noinstr+0xd/0xd0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 process_one_work+0x4c5/0xa10 ? __pfx_process_one_work+0x10/0x10 ? __list_add_valid_or_report+0x37/0x120 worker_thread+0x2f1/0x5a0 ? __kthread_parkme+0xde/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x1f0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x15b/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30  irq event stamp: 1116206 hardirqs last enabled at (1116205): [] __up_console_sem+0x52/0x60 hardirqs last disabled at (1116206): [] queue_delayed_work_on+0x6e/0xc0 softirqs last enabled at (1116138): [] __smb_send_rqst+0x42d/0x950 [cifs] softirqs last disabled at (1116136): [] release_sock+0x21/0xf0\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/cifsglob.h\",\"fs/smb/client/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"202d7e838967dda02855cd925db7fd8c52c56af7\",\"lessThan\":\"0cee638d92ac898d73eccc4e4bab70e9fc95946a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c34f1e095a12be3674fb79d84d1af7896e49245\",\"lessThan\":\"3f6932ef25378794894c3c1024092ad14da2d330\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f81ee0af2b8c4089e308f7cb6b5ea5a4efe5b94\",\"lessThan\":\"9d2b629a9dc5c72537645533af1cb11a7d34c4b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42ca547b13a20e7cbb04fbdf8d5f089ac4bb35b7\",\"lessThan\":\"3bbe46716092d8ef6b0df4b956f585c5cd0fc78e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/cifsglob.h\",\"fs/smb/client/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6.95\",\"lessThan\":\"6.6.97\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.35\",\"lessThan\":\"6.12.37\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.15.4\",\"lessThan\":\"6.15.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.95\",\"versionEndExcluding\":\"6.6.97\",\"matchCriteriaId\":\"CD4AB842-8CE8-4B2B-AB35-7A0CB834BB79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.35\",\"versionEndExcluding\":\"6.12.37\",\"matchCriteriaId\":\"94C5AF1D-C169-4AB9-8C6E-CDB6F3181468\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.15.4\",\"versionEndExcluding\":\"6.15.6\",\"matchCriteriaId\":\"C320AF0D-B4B6-4663-B73E-833679BE8464\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0cee638d92ac898d73eccc4e4bab70e9fc95946a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3bbe46716092d8ef6b0df4b956f585c5cd0fc78e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3f6932ef25378794894c3c1024092ad14da2d330\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9d2b629a9dc5c72537645533af1cb11a7d34c4b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:13:54+00:00",
      "cve": "CVE-2025-38379",
      "id": "CVE-2025-38379",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel SMB client: Denial of Service via uninitialized object during channel reconnection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38379.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:47:11Z",
      "cve": "CVE-2025-38379",
      "id": "CVE-2025-38379",
      "initial_release_date": "2025-07-26T23:21:37Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "326",
      "product_status:recommended": "402",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38379",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38379.json",
      "version": "26"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.