Executive brief
A vulnerability exists in the Linux kernel's CIFS (Common Internet File System) client when using RDMA transports. The system may crash (kernel oops) when processing network data if certain security hardening features are enabled. This impact is primarily on system availability, potentially causing a denial-of-service for systems mounting remote file shares.
Technical details
The vulnerability is a kernel panic (oops) triggered by the CONFIG_HARDENED_USERCOPY mechanism. In the smbdirect client code, received data is copied from the smbd_response struct's packet trailer to a folioq buffer using copy_to_iter(). Because the smbd_response slab objects were not explicitly marked as permitted for usercopy during creation, the hardened usercopy checks identify the operation as a potential kernel memory exposure and trigger a kernel BUG at mm/usercopy.c. This affects systems using CIFS over RDMA. The fix involves updating kmem_cache_create calls to include proper useroffset and usersize parameters in kmem_cache_args to whitelist the packet region for usercopy.
Affected products
- Linux Linux Kernel 6.12 to 6.12.35, 6.13 to 6.15.7
Timeline
- 2025-06-25: patched: Initial fix authored by David Howells
- 2025-08-16: disclosed: CVE-2025-38523 published