CVE-2025-21673

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix double free of TCP_Server_Info::hostname

When shutting down the server in cifs_put_tcp_session(), cifsd thread

might be reconnecting to multiple DFS targets before it realizes it

should exit the loop, so @server->hostname can't be freed as long as

cifsd thread isn't done. Otherwise the following can happen:

RIP: 0010:__slab_free+0x223/0x3c0

Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89

1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f>

0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80

RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246

RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068

RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400

RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000

R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500

R13: ffff8ea340042400 R14: ffff8ea34728e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References