Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-68226

Опубликовано: 16 дек. 2025
Источник: redhat
CVSS3: 5.5
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix incomplete backport in cfids_invalidation_worker() The previous commit bdb596ceb4b7 ("smb: client: fix potential UAF in smb2_close_cached_fid()") was an incomplete backport and missed one kref_put() call in cfids_invalidation_worker() that should have been converted to close_cached_dir().

A flaw was found in the Linux kernel’s SMB client implementation (fs/smb/client/cached_dir.c). An earlier commit intended to fix a potential use-after-free in smb2_close_cached_fid() was incompletely backported, resulting in a missing kref_put() call in the cfids_invalidation_worker() function. Under certain conditions, this can lead to a use-after-free of a reference counted object, potentially causing kernel instability or denial of service.

Меры по смягчению последствий

To mitigate this issue, prevent the cifs kernel module from loading. This can be achieved by creating a blacklist file.

  1. Create a file named /etc/modprobe.d/blacklist-cifs.conf with the following content:
blacklist cifs install cifs /bin/true
  1. Regenerate the initramfs:
dracut -f -v
  1. Reboot the system for the changes to take effect. Note that blacklisting the cifs module will disable SMB client functionality, which may impact systems relying on it for network file sharing.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 10kernelFix deferred
Red Hat Enterprise Linux 6kernelNot affected
Red Hat Enterprise Linux 7kernelNot affected
Red Hat Enterprise Linux 7kernel-rtNot affected
Red Hat Enterprise Linux 8kernelNot affected
Red Hat Enterprise Linux 8kernel-rtNot affected
Red Hat Enterprise Linux 9kernelFix deferred
Red Hat Enterprise Linux 9kernel-rtFix deferred

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-911
https://bugzilla.redhat.com/show_bug.cgi?id=2422705kernel: Linux kernel SMB client: Denial of Service due to Use-After-Free

EPSS

Процентиль: 8%
0.00027
Низкий

5.5 Medium

CVSS3

Связанные уязвимости

ubuntu
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix incomplete backport in cfids_invalidation_worker() The previous commit bdb596ceb4b7 ("smb: client: fix potential UAF in smb2_close_cached_fid()") was an incomplete backport and missed one kref_put() call in cfids_invalidation_worker() that should have been converted to close_cached_dir().

nvd
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix incomplete backport in cfids_invalidation_worker() The previous commit bdb596ceb4b7 ("smb: client: fix potential UAF in smb2_close_cached_fid()") was an incomplete backport and missed one kref_put() call in cfids_invalidation_worker() that should have been converted to close_cached_dir().

debian
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: s ...

github
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix incomplete backport in cfids_invalidation_worker() The previous commit bdb596ceb4b7 ("smb: client: fix potential UAF in smb2_close_cached_fid()") was an incomplete backport and missed one kref_put() call in cfids_invalidation_worker() that should have been converted to close_cached_dir().

EPSS

Процентиль: 8%
0.00027
Низкий

5.5 Medium

CVSS3