CVE-2025-38523

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix the smbd_response slab to allow usercopy

The handling of received data in the smbdirect client code involves using

copy_to_iter() to copy data from the smbd_reponse struct's packet trailer

to a folioq buffer provided by netfslib that encapsulates a chunk of

pagecache.

If, however, CONFIG_HARDENED_USERCOPY=y, this will result in the checks

then performed in copy_to_iter() oopsing with something like the following:

CIFS: Attempting to mount //172.31.9.1/test

CIFS: VFS: RDMA transport established

usercopy: Kernel memory exposure attempt detected from SLUB object 'smbd_response_0000000091e24ea1' (offset 81, size 63)!

------------[ cut here ]------------

kernel BUG at mm/usercopy.c:102!

...

RIP: 0010:usercopy_abort+0x6c/0x80

...

Call Trace:

<TASK>

__check_heap_object+0xe3/0x120

__check_object_size+0x4dc/0x6d0

smbd_recv+0x77f/0xfe0 [cifs]

cifs_readv_from_socket+0x276/0x8f0 [cifs]

cifs_read_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References