CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double free of TCPServerInfo::hostname
When shutting down the server in cifsputtcpsession(), cifsd thread might be reconnecting to multiple DFS targets before it realizes it should exit the loop, so @server->hostname can't be freed as long as cifsd thread isn't done. Otherwise the following can happen:
RIP: 0010:slabfree+0x223/0x3c0 Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f> 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80 RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246 RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068 RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400 RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000 R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500 R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068 FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000) 000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4: PKRU: 55555554 Call Trace: <TASK> ? showtraceloglvl+0x1c4/0x2df ? showtraceloglvl+0x1c4/0x2df ? reconnecttargetunlocked+0x3e/0x160 [cifs] ? diebody.cold+0x8/0xd ? die+0x2b/0x50 ? dotrap+0xce/0x120 ? slabfree+0x223/0x3c0 ? doerrortrap+0x65/0x80 ? slabfree+0x223/0x3c0 ? excinvalidop+0x4e/0x70 ? slabfree+0x223/0x3c0 ? asmexcinvalidop+0x16/0x20 ? slabfree+0x223/0x3c0 ? extracthostname+0x5c/0xa0 [cifs] ? extracthostname+0x5c/0xa0 [cifs] ? kmalloc+0x4b/0x140 reconnecttargetunlocked+0x3e/0x160 [cifs] reconnectdfsserver+0x145/0x430 [cifs] cifshandlestandard+0x1ad/0x1d0 [cifs] cifsdemultiplexthread+0x592/0x730 [cifs] ? pfxcifsdemultiplexthread+0x10/0x10 [cifs] kthread+0xdd/0x100 ? pfxkthread+0x10/0x10 retfromfork+0x29/0x50 </TASK>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.76.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21673?
CVE-2025-21673 is rated as a medium severity vulnerability.
How do I fix CVE-2025-21673?
Fixing CVE-2025-21673 involves updating to the latest version of the Linux kernel where this vulnerability has been patched.
What types of systems are affected by CVE-2025-21673?
CVE-2025-21673 affects systems running the Linux kernel, specifically those utilizing SMB client functionality.
What is the potential impact of CVE-2025-21673?
The potential impact of CVE-2025-21673 includes the risk of a double free vulnerability leading to arbitrary code execution or denial of service.
When was CVE-2025-21673 disclosed?
CVE-2025-21673 was disclosed as part of a series of kernel vulnerabilities addressing SMB client issues.