CVE-2025-22077
NoneCVSS
—
EPSS
0.4%
Published
Apr 16, 2025
CISA due date
—
Cloudanix analysis
A flaw in how the Linux kernel manages network references during file sharing connections can cause memory leaks or crashes that affect system stability.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Unbalanced get_net/put_net calls in the SMB client during mount, reconnect, and error paths lead to netns refcount leaks and premature netns release, enabling use-after-free conditions on the network namespace object.
Why it matters to the business
Kernel instability, memory leaks, and potential crashes can disrupt file sharing services, increase operational overhead for patching, and raise risk of service outages in environments relying on CIFS mounts; no ransomware or known active exploitation reduces immediate urgency.
How an attack unfolds
An attacker with the ability to trigger repeated CIFS mount attempts or network failures against a vulnerable kernel can induce refcount imbalance during generic_ip_connect and cifs_reconnect paths, leading to a freed netns being accessed later and potential kernel memory corruption.
How to fix it
Upgrade the Linux kernel to version 6.6.88 or apply the fix from commit 8dbf060480236877703bff0106fc984576184d11; Red Hat Enterprise Linux 9 users should update thunderbird and related packages to 0:128.5.0-1.el9_5 or later.
How to confirm the fix worked
Verify the running kernel version is at or above the fixed release, confirm netns refcount balancing in cifs_get_tcp_session and cifs_reconnect paths via source inspection, and test mount/reconnect scenarios under failure conditions to ensure no leaks occur.
Typical attack path
- Trigger CIFS mount or reconnect via network disruption or failed connections on ports 445/139
- Cause socket bind or connect failures in generic_ip_connect
- Force cifs_reconnect without corresponding put_net calls
- Reach clean_demultiplex_info or error paths that release the netns prematurely
- Access the freed netns object to trigger use-after-free
How to detect it
Review kernel logs for unbalanced netns refcount warnings or use-after-free crashes in cifs modules; inspect mount and reconnect sequences in audit logs for repeated failed connections on SMB ports followed by kernel panics.
What your security team should do
- Prioritize kernel updates on systems performing frequent CIFS mounts within the next maintenance window
- Monitor for kernel oops or slab corruption related to netns objects
- Restrict untrusted CIFS mount operations until patches are applied
The record
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix netns refcount imbalance causing leaks and use-after-free Commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") attempted to fix a netns use-after-free issue by manually adjusting reference counts via sk->sk_net_refcnt and sock_inuse_add(). However, a later commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod") pointed out that the approach of manually setting sk->sk_net_refcnt in the first commit was technically incorrect, as sk->sk_net_refcnt should only be set for user sockets. It led to issues like TCP timers not being cleared properly on close. The second commit moved to a model of just holding an extra netns reference for server->ssocket using get_net(), and dropping it when the server is torn down. But there remain some gaps in the get_net()/put_net() balancing added by these commits. The incomplete reference handling in these fixes results in two issues: 1. Netns refcount leaks[1] The problem process is as follows: ``` mount.cifs cifsd cifs_do_mount cifs_mount cifs_mount_get_session cifs_get_tcp_session get_net() /* First get net. */ ip_connect generic_ip_connect /* Try port 445 */ get_net() ->connect() /* Failed */ put_net() generic_ip_connect /* Try port 139 */ get_net() /* Missing matching put_net() for this get_net().*/ cifs_get_smb_ses cifs_negotiate_protocol smb2_negotiate SMB2_negotiate cifs_send_recv wait_for_response cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket cifs_reconnect cifs_abort_connection sock_release(); server->ssocket = NULL; /* Missing put_net() here. */ generic_ip_connect get_net() ->connect() /* Failed */ put_net() sock_release(); server->ssocket = NULL; free_rsp_buf ... clean_demultiplex_info /* It's only called once here. */ put_net() ``` When cifs_reconnect() is triggered, the server->ssocket is released without a corresponding put_net() for the reference acquired in generic_ip_connect() before. it ends up calling generic_ip_connect() again to retry get_net(). After that, server->ssocket is set to NULL in the error path of generic_ip_connect(), and the net count cannot be released in the final clean_demultiplex_info() function. 2. Potential use-after-free The current refcounting scheme can lead to a potential use-after-free issue in the following scenario: ``` cifs_do_mount cifs_mount cifs_mount_get_session cifs_get_tcp_session get_net() /* First get net */ ip_connect generic_ip_connect get_net() bind_socket kernel_bind /* failed */ put_net() /* after out_err_crypto_release label */ put_net() /* after out_err label */ put_net() ``` In the exception handling process where binding the socket fails, the get_net() and put_net() calls are unbalanced, which may cause the server->net reference count to drop to zero and be prematurely released. To address both issues, this patch ties the netns reference counti ---truncated---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.25-1 |
| Linux | Kernel | 0 | 6.6.88 |
| Mageia:9 | kernel | 0 | 6.6.88-3.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.88-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.0.24-70.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-78.mga9 |
| openSUSE:Leap 16.0 | dtb-aarch64 | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-64kb | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-default | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-default-base | 0 | 6.12.0-160000.6.1.160000.2.4 |
| openSUSE:Leap 16.0 | kernel-docs | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-kvmsmall | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-obs-build | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-obs-qa | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-rt | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-source | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-syms | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-zfcpdump | 0 | 6.12.0-160000.6.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39884 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix subvolume… Also affects linux
- CVE-2025-39886 In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39880 In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid… Also affects linux
- CVE-2025-39881 In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in… Also affects linux
- CVE-2025-39882 In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix… Also affects linux