CVE-2025-38488

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free in crypt_message when using async crypto

The CVE-2024-50047 fix removed asynchronous crypto handling from

crypt_message(), assuming all crypto operations are synchronous.

However, when hardware crypto accelerators are used, this can cause

use-after-free crashes:

crypt_message()

// Allocate the creq buffer containing the req

creq = smb2_get_aead_req(..., &req);

// Async encryption returns -EINPROGRESS immediately

rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);

// Free creq while async operation is still in progress

kvfree_sensitive(creq, ...);

Hardware crypto modules often implement async AEAD operations for

performance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,

the operation completes asynchronously. Without crypto_wait_req(),

the function immediately frees the request buffer, leading to crashes

when the driver later accesses

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References