CVE-2025-38379

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A local user could trigger a kernel warning when the SMB client attempts to reconnect a channel using an uninitialized object. This issue can lead to a system crash, resulting in a Denial of Service (DoS).

A moderate severity denial of service flaw was found in the Linux kernel SMB client (cifs). When an SMB channel is reconnected, smb2_reconnect_server() passes a dummy tcon with an uninitialized ->query_interface member down to smb2_reconnect(), which then attempts to queue delayed work on that uninitialized object, triggering a kernel WARNING that can lead to a system crash. A local user able to trigger an SMB channel reconnection on a system using an SMB mount could use this flaw to cause a denial of service.

This flaw affects the kernel in Red Hat Enterprise Linux 10, where the fix is currently deferred; the residual risk until a fix is delivered is that a local user could trigger the kernel warning and a resulting system crash on systems using the SMB client. Red Hat Enterprise Linux 6, 7, 8, and 9, and Red Hat In-Vehicle OS 1, are not affected because the vulnerable code is not present in those releases.

Red Hat rates this flaw as Moderate severity (CVSS 5.5, AV:L/PR:L), lower than the 7.5 (AV:N) score in the upstream CVE record, because triggering the issue requires local access to a system on which the SMB client performs a channel reconnection rather than remote network access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.