CVE-2025-37750

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix UAF in decryption with multichannel

After commit f7025d861694 ("smb: client: allocate crypto only for

primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in

async decryption"), the channels started reusing AEAD TFM from primary

channel to perform synchronous decryption, but that can't done as

there could be multiple cifsd threads (one per channel) simultaneously

accessing it to perform decryption.

This fixes the following KASAN splat when running fstest generic/249

with 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows

Server 2022:

BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110

Read of size 8 at addr ffff8881046c18a0 by task cifsd/986

CPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1

PREEMPT(voluntary)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41

04/01/2014

Call Trace:

<TASK>

dump_stack_lvl+0x5d/0x80

print_report+0x156/0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References