Executive brief
A vulnerability exists in the Linux kernel's SMB client, which is used to connect to network file shares. Under certain conditions when a connection attempt is retried, the system may attempt to use memory that has already been released. This could lead to a system crash or allow an attacker to gain unauthorized control over the affected system.
Technical details
A use-after-free (UAF) vulnerability exists in the smb2_query_info_compound() function within the Linux kernel's SMB client (CIFS). The root cause is a failure to reinitialize the 'cfid' (cached file ID) pointer to NULL during a retry/replay operation. If the first attempt allocates and then frees a cfid, the subsequent retry may operate on the stale pointer during cleanup or further processing. This can be triggered remotely via network interactions that cause the client to retry queries. Patches have been released across several stable kernel branches (6.6.y, 6.12.y, etc.) to ensure the pointer is properly reset under the replay label.
Affected products
- Linux Linux Kernel 6.6.32 to 6.6.117, 6.8 to 6.12.58, 6.17.8
Timeline
- 2025-10-27: other: Patch authored
- 2025-12-08: disclosed: CVE published