{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-22077","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.815Z","datePublished":"2025-04-16T14:12:27.882Z","dateUpdated":"2026-08-05T11:56:33.533Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:56:33.533Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"smb: client: fix TCP timers deadlock after rmmod\"\n\nThis reverts commit e9f2517a3e18a54a3943c098d2226b245d488801.\n\nCommit e9f2517a3e18 (\"smb: client: fix TCP timers deadlock after\nrmmod\") is intended to fix a null-ptr-deref in LOCKDEP, which is\nmentioned as CVE-2024-54680, but is actually did not fix anything;\nThe issue can be reproduced on top of it. [0]\n\nAlso, it reverted the change by commit ef7134c7fc48 (\"smb: client:\nFix use-after-free of network namespace.\") and introduced a real\nissue by reviving the kernel TCP socket.\n\nWhen a reconnect happens for a CIFS connection, the socket state\ntransitions to FIN_WAIT_1.  Then, inet_csk_clear_xmit_timers_sync()\nin tcp_close() stops all timers for the socket.\n\nIf an incoming FIN packet is lost, the socket will stay at FIN_WAIT_1\nforever, and such sockets could be leaked up to net.ipv4.tcp_max_orphans.\n\nUsually, FIN can be retransmitted by the peer, but if the peer aborts\nthe connection, the issue comes into reality.\n\nI warned about this privately by pointing out the exact report [1],\nbut the bogus fix was finally merged.\n\nSo, we should not stop the timers to finally kill the connection on\nour side in that case, meaning we must not use a kernel socket for\nTCP whose sk->sk_net_refcnt is 0.\n\nThe kernel socket does not have a reference to its netns to make it\npossible to tear down netns without cleaning up every resource in it.\n\nFor example, tunnel devices use a UDP socket internally, but we can\ndestroy netns without removing such devices and let it complete\nduring exit.  Otherwise, netns would be leaked when the last application\ndied.\n\nHowever, this is problematic for TCP sockets because TCP has timers to\nclose the connection gracefully even after the socket is close()d.  The\nlifetime of the socket and its netns is different from the lifetime of\nthe underlying connection.\n\nIf the socket user does not maintain the netns lifetime, the timer could\nbe fired after the socket is close()d and its netns is freed up, resulting\nin use-after-free.\n\nActually, we have seen so many similar issues and converted such sockets\nto have a reference to netns.\n\nThat's why I converted the CIFS client socket to have a reference to\nnetns (sk->sk_net_refcnt == 1), which is somehow mentioned as out-of-scope\nof CIFS and technically wrong in e9f2517a3e18, but **is in-scope and right\nfix**.\n\nRegarding the LOCKDEP issue, we can prevent the module unload by\nbumping the module refcount when switching the LOCKDDEP key in\nsock_lock_init_class_and_name(). [2]\n\nFor a while, let's revert the bogus fix.\n\nNote that now we can use sk_net_refcnt_upgrade() for the socket\nconversion, but I'll do so later separately to make backport easy."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The CIFS client's socket teardown/reconnect path is driven by the remote SMB peer — a malicious, compromised, or on-path-spoofed server forces reconnects (15s silence, RST) and aborts the connection so the FIN is never completed, leaking the orphaned socket and leaving a dangling netns pointer. No local access to the client is needed, only network reachability of the server the client already talks to.\nAC:L - The remote peer reliably controls both required conditions — causing the CIFS reconnect and aborting the connection instead of retransmitting FIN — and can repeat it arbitrarily many times to accumulate leaked orphans and hit the netns free window. Nothing depends on conditions outside the attacker's influence.\nPR:N - The attacker is the remote peer of an existing mount and holds no credentials or privileges on the victim kernel; the leak occurs in generic TCP socket teardown, well before or independent of any SMB authentication state.\nUI:N - Triggering only requires the normal reconnect handling of an already-established CIFS mount, which the server can force at will; no action by a local user or administrator is needed at exploitation time.\nS:U - The corrupted/exhausted resources (struct net, orphaned TCP sockets, kernel memory) are all managed by the same kernel security authority as the vulnerable code; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Reviving the kernel TCP socket (sk_net_refcnt=0) lets the orphaned sk outlive cifs's netns reference, reinstating the use-after-free of struct net that ef7134c7fc48 fixed; a freed-and-reallocated netns read through sock_net(sk) during packet processing gives an attacker-influenceable kernel memory read primitive.\nI:H - The same netns use-after-free means TCP/routing code writes through a stale struct net pointer (counters, hashinfo, death row state) into memory that may have been reallocated, which is a heap-spray-able write primitive rather than a benign read.\nA:H - Each forced reconnect permanently leaks a FIN_WAIT_1 orphan socket up to net.ipv4.tcp_max_orphans and leaks a netns refcount in cifs_abort_connection(), so a hostile server can exhaust system-wide orphan slots and pin network namespaces indefinitely; the reintroduced netns UAF additionally oopses the kernel (as in the original fib_rules_lookup crash report)."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/connect.c"],"versions":[{"version":"906807c734ed219dcb2e7bbfde5c4168ed72a3d0","lessThan":"8dbf060480236877703bff0106fc984576184d11","status":"affected","versionType":"git"},{"version":"127e907e11ccd54b59bb78fc22c43ccb76c71079","lessThan":"f761eeefd531e6550cd3a5c047835b4892acb00d","status":"affected","versionType":"git"},{"version":"e9f2517a3e18a54a3943c098d2226b245d488801","lessThan":"4b6f6bf1bde8d6045c389fda8d21c304dfe49384","status":"affected","versionType":"git"},{"version":"e9f2517a3e18a54a3943c098d2226b245d488801","lessThan":"95d2b9f693ff2a1180a23d7d59acc0c4e72f4c41","status":"affected","versionType":"git"},{"version":"6.6.68","lessThan":"6.6.88","status":"affected","versionType":"semver"},{"version":"6.12.7","lessThan":"6.12.25","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/connect.c"],"versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","status":"unaffected","versionType":"semver"},{"version":"6.6.88","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.25","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.14.4","lessThanOrEqual":"6.14.*","status":"unaffected","versionType":"semver"},{"version":"6.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.68","versionEndExcluding":"6.6.88"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.7","versionEndExcluding":"6.12.25"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.14.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.15"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8dbf060480236877703bff0106fc984576184d11"},{"url":"https://git.kernel.org/stable/c/f761eeefd531e6550cd3a5c047835b4892acb00d"},{"url":"https://git.kernel.org/stable/c/4b6f6bf1bde8d6045c389fda8d21c304dfe49384"},{"url":"https://git.kernel.org/stable/c/95d2b9f693ff2a1180a23d7d59acc0c4e72f4c41"}],"title":"Revert \"smb: client: fix TCP timers deadlock after rmmod\"","x_generator":{"engine":"bippy-1.2.0"}}}}