GHSA-P7CC-VWQP-JJ9Q
Vulnerability from github – Published: 2025-07-04 15:31 – Updated: 2025-11-19 21:31In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
This fixes the following problem:
[ 749.901015] [ T8673] run fstests cifs/001 at 2025-06-17 09:40:30 [ 750.346409] [ T9870] ================================================================== [ 750.346814] [ T9870] BUG: KASAN: slab-out-of-bounds in smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.347330] [ T9870] Write of size 8 at addr ffff888011082890 by task xfs_io/9870 [ 750.347705] [ T9870] [ 750.348077] [ T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary) [ 750.348082] [ T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 750.348085] [ T9870] Call Trace: [ 750.348086] [ T9870] [ 750.348088] [ T9870] dump_stack_lvl+0x76/0xa0 [ 750.348106] [ T9870] print_report+0xd1/0x640 [ 750.348116] [ T9870] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 750.348120] [ T9870] ? kasan_complete_mode_report_info+0x26/0x210 [ 750.348124] [ T9870] kasan_report+0xe7/0x130 [ 750.348128] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348262] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348377] [ T9870] __asan_report_store8_noabort+0x17/0x30 [ 750.348381] [ T9870] smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348496] [ T9870] smbd_post_send_iter+0x1990/0x3070 [cifs] [ 750.348625] [ T9870] ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs] [ 750.348741] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348749] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348870] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348990] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348995] [ T9870] smbd_send+0x58c/0x9c0 [cifs] [ 750.349117] [ T9870] ? __pfx_smbd_send+0x10/0x10 [cifs] [ 750.349231] [ T9870] ? unwind_get_return_address+0x65/0xb0 [ 750.349235] [ T9870] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 750.349242] [ T9870] ? arch_stack_walk+0xa7/0x100 [ 750.349250] [ T9870] ? stack_trace_save+0x92/0xd0 [ 750.349254] [ T9870] __smb_send_rqst+0x931/0xec0 [cifs] [ 750.349374] [ T9870] ? kernel_text_address+0x173/0x190 [ 750.349379] [ T9870] ? kasan_save_stack+0x39/0x70 [ 750.349382] [ T9870] ? kasan_save_track+0x18/0x70 [ 750.349385] [ T9870] ? __kasan_slab_alloc+0x9d/0xa0 [ 750.349389] [ T9870] ? __pfxsmbsend_rqst+0x10/0x10 [cifs] [ 750.349508] [ T9870] ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs] [ 750.349626] [ T9870] ? cifs_call_async+0x277/0xb00 [cifs] [ 750.349746] [ T9870] ? cifs_issue_write+0x256/0x610 [cifs] [ 750.349867] [ T9870] ? netfs_do_issue_write+0xc2/0x340 [netfs] [ 750.349900] [ T9870] ? netfs_advance_write+0x45b/0x1270 [netfs] [ 750.349929] [ T9870] ? netfs_write_folio+0xd6c/0x1be0 [netfs] [ 750.349958] [ T9870] ? netfs_writepages+0x2e9/0xa80 [netfs] [ 750.349987] [ T9870] ? do_writepages+0x21f/0x590 [ 750.349993] [ T9870] ? filemap_fdatawrite_wbc+0xe1/0x140 [ 750.349997] [ T9870] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.350002] [ T9870] smb_send_rqst+0x22e/0x2f0 [cifs] [ 750.350131] [ T9870] ? pfx_smb_send_rqst+0x10/0x10 [cifs] [ 750.350255] [ T9870] ? local_clock_noinstr+0xe/0xd0 [ 750.350261] [ T9870] ? kasan_save_alloc_info+0x37/0x60 [ 750.350268] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350271] [ T9870] ? _raw_spin_lock+0x81/0xf0 [ 750.350275] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350278] [ T9870] ? smb2_setup_async_request+0x293/0x580 [cifs] [ 750.350398] [ T9870] cifs_call_async+0x477/0xb00 [cifs] [ 750.350518] [ T9870] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [ 750.350636] [ T9870] ? __pfx_cifs_call_async+0x10/0x10 [cifs] [ 750.350756] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350760] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350763] [ T98 ---truncated---
{
"affected": [],
"aliases": [
"CVE-2025-38179"
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-04T14:15:24Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()\n\nThis fixes the following problem:\n\n[ 749.901015] [ T8673] run fstests cifs/001 at 2025-06-17 09:40:30\n[ 750.346409] [ T9870] ==================================================================\n[ 750.346814] [ T9870] BUG: KASAN: slab-out-of-bounds in smb_set_sge+0x2cc/0x3b0 [cifs]\n[ 750.347330] [ T9870] Write of size 8 at addr ffff888011082890 by task xfs_io/9870\n[ 750.347705] [ T9870]\n[ 750.348077] [ T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary)\n[ 750.348082] [ T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\n[ 750.348085] [ T9870] Call Trace:\n[ 750.348086] [ T9870] \u003cTASK\u003e\n[ 750.348088] [ T9870] dump_stack_lvl+0x76/0xa0\n[ 750.348106] [ T9870] print_report+0xd1/0x640\n[ 750.348116] [ T9870] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 750.348120] [ T9870] ? kasan_complete_mode_report_info+0x26/0x210\n[ 750.348124] [ T9870] kasan_report+0xe7/0x130\n[ 750.348128] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs]\n[ 750.348262] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs]\n[ 750.348377] [ T9870] __asan_report_store8_noabort+0x17/0x30\n[ 750.348381] [ T9870] smb_set_sge+0x2cc/0x3b0 [cifs]\n[ 750.348496] [ T9870] smbd_post_send_iter+0x1990/0x3070 [cifs]\n[ 750.348625] [ T9870] ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs]\n[ 750.348741] [ T9870] ? update_stack_state+0x2a0/0x670\n[ 750.348749] [ T9870] ? cifs_flush+0x153/0x320 [cifs]\n[ 750.348870] [ T9870] ? cifs_flush+0x153/0x320 [cifs]\n[ 750.348990] [ T9870] ? update_stack_state+0x2a0/0x670\n[ 750.348995] [ T9870] smbd_send+0x58c/0x9c0 [cifs]\n[ 750.349117] [ T9870] ? __pfx_smbd_send+0x10/0x10 [cifs]\n[ 750.349231] [ T9870] ? unwind_get_return_address+0x65/0xb0\n[ 750.349235] [ T9870] ? __pfx_stack_trace_consume_entry+0x10/0x10\n[ 750.349242] [ T9870] ? arch_stack_walk+0xa7/0x100\n[ 750.349250] [ T9870] ? stack_trace_save+0x92/0xd0\n[ 750.349254] [ T9870] __smb_send_rqst+0x931/0xec0 [cifs]\n[ 750.349374] [ T9870] ? kernel_text_address+0x173/0x190\n[ 750.349379] [ T9870] ? kasan_save_stack+0x39/0x70\n[ 750.349382] [ T9870] ? kasan_save_track+0x18/0x70\n[ 750.349385] [ T9870] ? __kasan_slab_alloc+0x9d/0xa0\n[ 750.349389] [ T9870] ? __pfx___smb_send_rqst+0x10/0x10 [cifs]\n[ 750.349508] [ T9870] ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs]\n[ 750.349626] [ T9870] ? cifs_call_async+0x277/0xb00 [cifs]\n[ 750.349746] [ T9870] ? cifs_issue_write+0x256/0x610 [cifs]\n[ 750.349867] [ T9870] ? netfs_do_issue_write+0xc2/0x340 [netfs]\n[ 750.349900] [ T9870] ? netfs_advance_write+0x45b/0x1270 [netfs]\n[ 750.349929] [ T9870] ? netfs_write_folio+0xd6c/0x1be0 [netfs]\n[ 750.349958] [ T9870] ? netfs_writepages+0x2e9/0xa80 [netfs]\n[ 750.349987] [ T9870] ? do_writepages+0x21f/0x590\n[ 750.349993] [ T9870] ? filemap_fdatawrite_wbc+0xe1/0x140\n[ 750.349997] [ T9870] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 750.350002] [ T9870] smb_send_rqst+0x22e/0x2f0 [cifs]\n[ 750.350131] [ T9870] ? __pfx_smb_send_rqst+0x10/0x10 [cifs]\n[ 750.350255] [ T9870] ? local_clock_noinstr+0xe/0xd0\n[ 750.350261] [ T9870] ? kasan_save_alloc_info+0x37/0x60\n[ 750.350268] [ T9870] ? __kasan_check_write+0x14/0x30\n[ 750.350271] [ T9870] ? _raw_spin_lock+0x81/0xf0\n[ 750.350275] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10\n[ 750.350278] [ T9870] ? smb2_setup_async_request+0x293/0x580 [cifs]\n[ 750.350398] [ T9870] cifs_call_async+0x477/0xb00 [cifs]\n[ 750.350518] [ T9870] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]\n[ 750.350636] [ T9870] ? __pfx_cifs_call_async+0x10/0x10 [cifs]\n[ 750.350756] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10\n[ 750.350760] [ T9870] ? __kasan_check_write+0x14/0x30\n[ 750.350763] [ T98\n---truncated---",
"id": "GHSA-p7cc-vwqp-jj9q",
"modified": "2025-11-19T21:31:14Z",
"published": "2025-07-04T15:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38179"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8ae7814589d7bd850294ac14ec4c1725dafd42ca"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a379a8a2a0032e12e7ef397197c9c2ad011588d6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e0ba9b2f188166550296005e64b15e80db82ad8a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.