CVE-2025-38379

smb: client: fix warning when reconnecting channel

published July 25, 2025

CVSS
—
EPSS
0%
Percentile
31.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix warning when reconnecting channel

When reconnecting a channel in smb2_reconnect_server(), a dummy tcon

is passed down to smb2_reconnect() with ->query_interface

uninitialized, so we can't call queue_delayed_work() on it.

Fix the following warning by ensuring that we're queueing the delayed

worker from correct tcon.

WARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200

Modules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]

CPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014

Workqueue: cifsiod smb2_reconnect_server [cifs]

RIP: 0010:__queue_delayed_work+0x1d2/0x200

Code: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00

00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f> 0b 90 e9 65 fe

ff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9

RSP: 0018:ffffc900014afad8 EFLAGS: 00010003

RAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1

RDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0

RBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331

R10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040

R13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020

FS: 0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0

PKRU: 55555554

Call Trace:

<TASK>

queue_delayed_work_on+0xb4/0xc0

smb2_reconnect+0xb22/0xf50 [cifs]

smb2_reconnect_server+0x413/0xd40 [cifs]

? __pfx_smb2_reconnect_server+0x10/0x10 [cifs]

? local_clock_noinstr+0xd/0xd0

? local_clock+0x15/0x30

? lock_release+0x29b/0x390

process_one_work+0x4c5/0xa10

? __pfx_process_one_work+0x10/0x10

? __list_add_valid_or_report+0x37/0x120

worker_thread+0x2f1/0x5a0

? __kthread_parkme+0xde/0x100

? __pfx_worker_thread+0x10/0x10

kthread+0x1fe/0x380

? kthread+0x10f/0x380

? __pfx_kthread+0x10/0x10

? local_clock_noinstr+0xd/0xd0

? ret_from_fork+0x1b/0x1f0

? local_clock+0x15/0x30

? lock_release+0x29b/0x390

? rcu_is_watching+0x20/0x50

? __pfx_kthread+0x10/0x10

ret_from_fork+0x15b/0x1f0

? __pfx_kthread+0x10/0x10

ret_from_fork_asm+0x1a/0x30

</TASK>

irq event stamp: 1116206

hardirqs last enabled at (1116205): [<ffffffff8143af42>] __up_console_sem+0x52/0x60

hardirqs last disabled at (1116206): [<ffffffff81399f0e>] queue_delayed_work_on+0x6e/0xc0

softirqs last enabled at (1116138): [<ffffffffc04562fd>] __smb_send_rqst+0x42d/0x950 [cifs]

softirqs last disabled at (1116136): [<ffffffff823d35e1>] release_sock+0x21/0xf0

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.1th percentile
Published
2025-07-25T12:53Z
EPSS history
Timeline
  • 25 JUL 12:53Z
    smb: client: fix warning when reconnecting channel
    cvelistv5