Listen to this Post
How the mentioned CVE works:
A use-after-free vulnerability exists in the Linux kernel’s SMB client. During server reconnection, the function `smb2_reconnect_server()` passes a dummy tree connection (tcon) structure to smb2_reconnect(). This dummy tcon has its `->query_interface` member uninitialized. When the reconnection logic attempts to queue a delayed work item using this uninitialized pointer, it triggers a kernel warning. This occurs because the code path incorrectly uses a temporary, invalid tcon instead of the correct, persistent one for scheduling the interface query work, leading to a reference to a freed or invalid object.
Platform: Linux Kernel
Version: Up to 6.16.0-rc3
Vulnerability: Use-After-Free
Severity: Medium
date: 2025-07-25
Prediction: Patch by 2025-08-08
What Undercode Say:
dmesg | grep -i "WARNING.workqueue" cat /proc/version git log --oneline --grep="smb2_reconnect"
// In smb2_reconnect_server() struct cifs_tcon dummy_tcon; // ->query_interface is uninitialized smb2_reconnect(..., dummy_tcon, ...);
// The fix ensures the correct tcon is used queue_delayed_work(system_long_wq, &tcon->query_interface, 0);
How Exploit:
Kernel crash (DoS)
Kernel memory leak
Potential code execution
Protection from this CVE:
Update Linux kernel
Apply kernel patch
Disable unnecessary CIFS
Impact:
System instability
Denial of Service
Information disclosure
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
