UBUNTU-CVE-2025-38208

In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automountfullpath page is checked for null in buildpathfromdentryoptionalprefix when tcon-originfullpath is not set. However, the check is missing when it is set. Add a check to prevent a potential...

CVE-2025-38208 smb: client: add NULL check in automount_fullpath

In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automountfullpath page is checked for null in buildpathfromdentryoptionalprefix when tcon-originfullpath is not set. However, the check is missing when it is set. Add a check to prevent a potential...

CVE-2025-38208

CVE-2025-38208 is resolved in the Linux kernel: smb client adds a NULL check in automount_fullpath to prevent NULL dereference when tcon->origin_fullpath is set. The issue was a missing null check in __build_path_from_dentry_optional_prefix for the case when origin_fullpath is present. Affects...

CVE-2025-38179

Technical details about CVE-2025-38179 (affected product/component, root cause, impact, exploitability, or patch information) are not publicly provided in the connected documents. Monitor for updates.

CVE-2025-38179 smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix maxsge overflow in smbextractfolioqtordma This fixes the following problem: 749.901015 T8673 run fstests cifs/001 at 2025-06-17 09:40:30 750.346409 T9870...

CVE-2025-38179

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix maxsge overflow in smbextractfolioqtordma This fixes the following problem: 749.901015 T8673 run fstests cifs/001 at 2025-06-17 09:40:30 750.346409 T9870...

CVE-2025-38179 smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix maxsge overflow in smbextractfolioqtordma This fixes the following problem: 749.901015 T8673 run fstests cifs/001 at 2025-06-17 09:40:30 750.346409 T9870...

The vulnerability of the `find_or_create_cached_dir()` function in the fs/smb/client/cached_dir.c module allows a hacker to cause a service failure in Linux-based operating systems with SMB kernel support.

The vulnerability of the findorcreatecacheddir function in the fs/smb/client/cacheddir.c module, which is part of the SMB client support in Linux kernel, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

kernel: smb: client: fix UAF in decryption with multichannel

A use-after-free UAF vulnerability was found in the Linux kernel's SMB client functionality. A local attacker with permissions to connect to arbitrary SMB servers with precise timing could exploit this flaw to alter system memory, leading to denials of service, alteration of sensitive memory...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocateonefolio CVE-2024-56758 In the Linux kernel, the following vulnerability has been resolved: hrtimers: Force migrate away hrtimers queued after CPUHPAPHRTIMERSDYIN...

CVE-2025-38051

CVE-2025-38051 affects the Linux kernel CIFS client: a race in the readdir/concurrency path allows a use-after-free in cifs_fill_dirent when the rsp buffer is freed, leading to a reported KASAN-use-after-free. The vulnerability is tracked with a CVSSv3.1 vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a post-release reuse issue in the readdir concurrency process in the smb client...

📄 Microsoft Windows 11 SMB Client Privilege Escalation / Remote Code Execution

This proof of concept demonstrates a complex attack chain exploiting improper access control in Windows SMB clients, leading to elevation of privilege through DNS record injection, NTLM relay attacks using impacket-ntlmrelayx, and coercion of a victim system including Windows 11 to authenticate t...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: smb: client: Added a check for nextbuffer in receiveencryptedstandard. Added a check on the return values of cifsbufget and cifssmallbufget in receiveencryptedstandard to prevent null pointer dereferencing...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed UAF in async decryption Performing async decryption large read results in a crash due to a slabuseafterfree issue in the crypto API. Reproducing the issue: mount.cifs -o ...,seal,esize=1 //srv/share /mnt dd...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: smb: client: Avoid race conditions in opencacheddir when leases are broken. A previously valid cfid returned from findorcreatecacheddir might cause a race condition with a lease break. As a result, opencacheddir may not consid...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: smb: client: Fixed a UAF Use-After-Free error in decryption with multichannel. After the commits f7025d861694 “smb: client: allocate crypto only for primary server” and b0abcd65ec54 “smb: client: fix UAF in async decryption”,...

kernel: smb: client: fix UAF in decryption with multichannel

A use-after-free UAF vulnerability was found in the Linux kernel's SMB client functionality. A local attacker with permissions to connect to arbitrary SMB servers with precise timing could exploit this flaw to alter system memory, leading to denials of service, alteration of sensitive memory...

The vulnerability in the fs/smb/client/cached_dir.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the fs/smb/client/cacheddir.c module of the Linux operating system is related to errors during the update of the link counters. Exploiting this vulnerability can allow an attacker to cause a service failure...

Windows 11 SMB Client - Privilege Escalation & Remote Code Execution (RCE)

!/usr/bin/env python3 Exploit Title: Windows 11 SMB Client - Privilege Escalation & Remote Code Execution RCE Author: Mohammed Idrees Banyamer Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer Date: 2025-06-13 Tested on: Windows 11 version 22H2, Windows Server 2022, Kali Linux...