CVE-2025-40052

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix crypto buffers in non-linear memory

The crypto API, through the scatterlist API, expects input buffers to be

in linear memory. We handle this with the cifs_sg_set_buf() helper

that converts vmalloc'd memory to their corresponding pages.

However, when we allocate our aead_request buffer (@creq in

smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly

puts aead_request->__ctx in vmalloc area.

AEAD algorithm then uses ->__ctx for its private/internal data and

operations, and uses sg_set_buf() for such data on a few places.

This works fine as long as @creq falls into kmalloc zone (small

requests) or vmalloc'd memory is still within linear range.

Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too

many tasks will increment the base stacks' addresses to a point where

virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that

happens.

In practice: too many paralle

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References