Critical Vulnerability in Linux Package: SMB Client Channel Reconnection Issue
Summary
DEBIAN-CVE-2025-38379: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning when reconnecting channel When reconnecting a channel in smb2_reconnect_server(), a dummy tcon is passed down to smb2_reconnect... Affects linux versions < 6.12.37-1. Fixed in 6.12.37-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing system resources and hardware interactions. It supports a wide range of applications and services, making it a critical part of both server and desktop environments. This vulnerability specifically affects the SMB client functionality, which is responsible for handling file and printer sharing over a network. The issue arises during the reconnection of channels, leading to potential system warnings and instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SMB client where a dummy tcon is passed to the smb2_reconnect function with an uninitialized ->query_interface. This can lead to warnings during the reconnection process, as the system attempts to queue a delayed work item on an incorrect tcon. The warning message indicates a potential flaw in the workqueue handling, which could affect the stability and performance of the SMB client operations.
How To Fix
Minimum fixed version
6.12.37-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate any potential risks.
Conclusion
The identified vulnerability in the Linux package poses a risk to the stability of SMB client operations. Users are encouraged to update to the patched version to ensure their systems remain secure and functional. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves an uninitialized variable in the SMB client, which can lead to warnings and potential instability during channel reconnections.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The primary impact is the generation of warnings during SMB operations, which may affect the performance and reliability of file sharing services.
Yes, a patch has been released in version 6.12.37-1 of the Linux package for both Debian 13 and 14.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as possible to avoid potential issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
