CVE-2025-38379 (GCVE-0-2025-38379)
Vulnerability from cvelistv5
Published
2025-07-25 12:53
Modified
2025-07-28 04:20
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning when reconnecting channel When reconnecting a channel in smb2_reconnect_server(), a dummy tcon is passed down to smb2_reconnect() with ->query_interface uninitialized, so we can't call queue_delayed_work() on it. Fix the following warning by ensuring that we're queueing the delayed worker from correct tcon. WARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200 Modules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__queue_delayed_work+0x1d2/0x200 Code: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00 00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f> 0b 90 e9 65 fe ff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9 RSP: 0018:ffffc900014afad8 EFLAGS: 00010003 RAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1 RDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0 RBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331 R10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040 R13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020 FS: 0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> queue_delayed_work_on+0xb4/0xc0 smb2_reconnect+0xb22/0xf50 [cifs] smb2_reconnect_server+0x413/0xd40 [cifs] ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs] ? local_clock_noinstr+0xd/0xd0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 process_one_work+0x4c5/0xa10 ? __pfx_process_one_work+0x10/0x10 ? __list_add_valid_or_report+0x37/0x120 worker_thread+0x2f1/0x5a0 ? __kthread_parkme+0xde/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x1f0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x15b/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 1116206 hardirqs last enabled at (1116205): [<ffffffff8143af42>] __up_console_sem+0x52/0x60 hardirqs last disabled at (1116206): [<ffffffff81399f0e>] queue_delayed_work_on+0x6e/0xc0 softirqs last enabled at (1116138): [<ffffffffc04562fd>] __smb_send_rqst+0x42d/0x950 [cifs] softirqs last disabled at (1116136): [<ffffffff823d35e1>] release_sock+0x21/0xf0
References
Impacted products
Vendor Product Version
Linux Linux Version: 202d7e838967dda02855cd925db7fd8c52c56af7
Version: 2c34f1e095a12be3674fb79d84d1af7896e49245
Version: 4f81ee0af2b8c4089e308f7cb6b5ea5a4efe5b94
Version: 42ca547b13a20e7cbb04fbdf8d5f089ac4bb35b7
 Create a notification for this product.
   Linux Linux Version: 6.6.95   ≤
Version: 6.12.35   ≤
Version: 6.15.4   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsglob.h",
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0cee638d92ac898d73eccc4e4bab70e9fc95946a",
              "status": "affected",
              "version": "202d7e838967dda02855cd925db7fd8c52c56af7",
              "versionType": "git"
            },
            {
              "lessThan": "3f6932ef25378794894c3c1024092ad14da2d330",
              "status": "affected",
              "version": "2c34f1e095a12be3674fb79d84d1af7896e49245",
              "versionType": "git"
            },
            {
              "lessThan": "9d2b629a9dc5c72537645533af1cb11a7d34c4b1",
              "status": "affected",
              "version": "4f81ee0af2b8c4089e308f7cb6b5ea5a4efe5b94",
              "versionType": "git"
            },
            {
              "lessThan": "3bbe46716092d8ef6b0df4b956f585c5cd0fc78e",
              "status": "affected",
              "version": "42ca547b13a20e7cbb04fbdf8d5f089ac4bb35b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsglob.h",
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.97",
              "status": "affected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.37",
              "status": "affected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15.6",
              "status": "affected",
              "version": "6.15.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "6.6.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.12.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.15.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix warning when reconnecting channel\n\nWhen reconnecting a channel in smb2_reconnect_server(), a dummy tcon\nis passed down to smb2_reconnect() with -\u003equery_interface\nuninitialized, so we can\u0027t call queue_delayed_work() on it.\n\nFix the following warning by ensuring that we\u0027re queueing the delayed\nworker from correct tcon.\n\nWARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200\nModules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\nCPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014\nWorkqueue: cifsiod smb2_reconnect_server [cifs]\nRIP: 0010:__queue_delayed_work+0x1d2/0x200\nCode: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00\n00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f\u003e 0b 90 e9 65 fe\nff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9\nRSP: 0018:ffffc900014afad8 EFLAGS: 00010003\nRAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1\nRDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0\nRBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331\nR10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040\nR13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020\nFS:  0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n queue_delayed_work_on+0xb4/0xc0\n smb2_reconnect+0xb22/0xf50 [cifs]\n smb2_reconnect_server+0x413/0xd40 [cifs]\n ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs]\n ? local_clock_noinstr+0xd/0xd0\n ? local_clock+0x15/0x30\n ? lock_release+0x29b/0x390\n process_one_work+0x4c5/0xa10\n ? __pfx_process_one_work+0x10/0x10\n ? __list_add_valid_or_report+0x37/0x120\n worker_thread+0x2f1/0x5a0\n ? __kthread_parkme+0xde/0x100\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1fe/0x380\n ? kthread+0x10f/0x380\n ? __pfx_kthread+0x10/0x10\n ? local_clock_noinstr+0xd/0xd0\n ? ret_from_fork+0x1b/0x1f0\n ? local_clock+0x15/0x30\n ? lock_release+0x29b/0x390\n ? rcu_is_watching+0x20/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x15b/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\nirq event stamp: 1116206\nhardirqs last  enabled at (1116205): [\u003cffffffff8143af42\u003e] __up_console_sem+0x52/0x60\nhardirqs last disabled at (1116206): [\u003cffffffff81399f0e\u003e] queue_delayed_work_on+0x6e/0xc0\nsoftirqs last  enabled at (1116138): [\u003cffffffffc04562fd\u003e] __smb_send_rqst+0x42d/0x950 [cifs]\nsoftirqs last disabled at (1116136): [\u003cffffffff823d35e1\u003e] release_sock+0x21/0xf0"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:20:26.678Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0cee638d92ac898d73eccc4e4bab70e9fc95946a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f6932ef25378794894c3c1024092ad14da2d330"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d2b629a9dc5c72537645533af1cb11a7d34c4b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bbe46716092d8ef6b0df4b956f585c5cd0fc78e"
        }
      ],
      "title": "smb: client: fix warning when reconnecting channel",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38379",
    "datePublished": "2025-07-25T12:53:21.098Z",
    "dateReserved": "2025-04-16T04:51:24.010Z",
    "dateUpdated": "2025-07-28T04:20:26.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38379\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:27.033\",\"lastModified\":\"2025-07-25T15:29:19.837\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix warning when reconnecting channel\\n\\nWhen reconnecting a channel in smb2_reconnect_server(), a dummy tcon\\nis passed down to smb2_reconnect() with -\u003equery_interface\\nuninitialized, so we can\u0027t call queue_delayed_work() on it.\\n\\nFix the following warning by ensuring that we\u0027re queueing the delayed\\nworker from correct tcon.\\n\\nWARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200\\nModules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\\nCPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary)\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014\\nWorkqueue: cifsiod smb2_reconnect_server [cifs]\\nRIP: 0010:__queue_delayed_work+0x1d2/0x200\\nCode: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00\\n00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f\u003e 0b 90 e9 65 fe\\nff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9\\nRSP: 0018:ffffc900014afad8 EFLAGS: 00010003\\nRAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1\\nRDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0\\nRBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331\\nR10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040\\nR13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020\\nFS:  0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0\\nPKRU: 55555554\\nCall Trace:\\n \u003cTASK\u003e\\n queue_delayed_work_on+0xb4/0xc0\\n smb2_reconnect+0xb22/0xf50 [cifs]\\n smb2_reconnect_server+0x413/0xd40 [cifs]\\n ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs]\\n ? local_clock_noinstr+0xd/0xd0\\n ? local_clock+0x15/0x30\\n ? lock_release+0x29b/0x390\\n process_one_work+0x4c5/0xa10\\n ? __pfx_process_one_work+0x10/0x10\\n ? __list_add_valid_or_report+0x37/0x120\\n worker_thread+0x2f1/0x5a0\\n ? __kthread_parkme+0xde/0x100\\n ? __pfx_worker_thread+0x10/0x10\\n kthread+0x1fe/0x380\\n ? kthread+0x10f/0x380\\n ? __pfx_kthread+0x10/0x10\\n ? local_clock_noinstr+0xd/0xd0\\n ? ret_from_fork+0x1b/0x1f0\\n ? local_clock+0x15/0x30\\n ? lock_release+0x29b/0x390\\n ? rcu_is_watching+0x20/0x50\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x15b/0x1f0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\nirq event stamp: 1116206\\nhardirqs last  enabled at (1116205): [\u003cffffffff8143af42\u003e] __up_console_sem+0x52/0x60\\nhardirqs last disabled at (1116206): [\u003cffffffff81399f0e\u003e] queue_delayed_work_on+0x6e/0xc0\\nsoftirqs last  enabled at (1116138): [\u003cffffffffc04562fd\u003e] __smb_send_rqst+0x42d/0x950 [cifs]\\nsoftirqs last disabled at (1116136): [\u003cffffffff823d35e1\u003e] release_sock+0x21/0xf0\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0cee638d92ac898d73eccc4e4bab70e9fc95946a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3bbe46716092d8ef6b0df4b956f585c5cd0fc78e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3f6932ef25378794894c3c1024092ad14da2d330\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9d2b629a9dc5c72537645533af1cb11a7d34c4b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.