CVE-2025-38523
BaseFortify
Publication date: 2025-08-16
Last updated on: 2025-11-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1188 | The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in the Linux kernel's CIFS (Common Internet File System) client code, specifically in the handling of received data in the smbd_response slab. The issue arises because the packet field in the smbd_response slab is not marked as permitted for usercopy operations. When CONFIG_HARDENED_USERCOPY is enabled, the kernel's copy_to_iter() function, which copies data from the smbd_response struct to a buffer, triggers a kernel oops (crash) due to security checks detecting an invalid usercopy attempt. The fix involves marking the packet region of the smbd_response slab as permitted for usercopy to prevent this crash.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash (kernel BUG) when the CIFS client attempts to copy data from the smbd_response slab if hardened usercopy protections are enabled. This can lead to denial of service by crashing the system or the CIFS client, potentially disrupting access to network file shares.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel logs for oops messages related to usercopy failures in the CIFS smbd_response slab. Specifically, look for messages like 'usercopy: Kernel memory exposure attempt detected from SLUB object smbd_response' and kernel BUG traces referencing usercopy_abort and smbd_recv. You can check the kernel log using commands such as 'dmesg | grep usercopy' or 'journalctl -k | grep usercopy' to identify these errors.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the smbd_response slab is properly marked to allow usercopy, as the vulnerability is fixed by passing parameters to kmem_slab_create() to permit copy_to_iter() from the packet region. Until an update is applied, monitoring for kernel oops messages and avoiding mounting CIFS shares that trigger this issue may reduce risk.