Double Free Vulnerability in Linux Kernel's CIFS Client - CVE-2025-21673
Summary
CVE-2025-21673: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double free of TCP_Server_Info::hostname When shutting down the server in cifs_put_tcp_session(), cifsd thread might be reconnecting to... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of many operating systems, providing essential services and hardware management. It supports various functionalities, including file systems, networking, and process management. The Common Internet File System (CIFS) is a protocol that allows file sharing over a network. This vulnerability affects the CIFS client within the Linux kernel, specifically in the handling of TCP server information.
Vulnerability Detail
CVE-2025-21673 is a double free vulnerability that occurs in the Linux kernel's CIFS client. The issue arises when the server is shut down in the cifs_put_tcp_session() function. A cifsd thread may attempt to reconnect to multiple Distributed File System (DFS) targets before it realizes it should exit the loop. This can lead to the hostname of the server not being freed properly, resulting in potential memory corruption and crashes. The technical details indicate that the vulnerability can cause a system to reach an invalid operation state, leading to a crash or unexpected behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-21673 is a significant vulnerability in the Linux kernel's CIFS client that can lead to memory corruption and system instability. Users are encouraged to update their systems to the latest patched versions to ensure protection against this issue. Regular monitoring using tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21673 is a double free vulnerability in the Linux kernel's CIFS client that can lead to memory corruption and system crashes.
If your system uses the CIFS protocol for file sharing, this vulnerability could lead to crashes or unexpected behavior during server shutdowns.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, a patch has been released for Debian 12 and 13. Updating your Linux package will resolve the issue.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
