High

Use-after-free in Linux kernel SMB client decryption with multichannel

IdentifiersCVE-2025-37750CWE-416· Use After Free

CVE-2025-37750 is a use-after-free vulnerability in the Linux kernel CIFS/SMB client implementation affecting SMB3 encryption handling when multichannel is enabled. The flaw was introduced by changes that caused secondary channels to reuse the AEAD transform object allocated for the primary server channel during synchronous decryption. In a multichannel configuration, multiple cifsd threads can process traffic concurrently, and simultaneous access to the shared AEAD transform can result in a stale memory reference during decryption. The fault manifests in the SMB client decryption path, including crypt_message, decrypt_raw_data, and smb3_receive_transform, and was observed as a KASAN-reported slab use-after-free during GCM/GHASH processing. The vulnerability can lead to kernel memory corruption during processing of encrypted SMB traffic.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can trigger kernel memory corruption in the SMB client, leading at minimum to denial of service through kernel crashes or instability. Because the flaw is a use-after-free in kernel-space cryptographic processing, further impact could include undefined behavior and potentially more serious compromise depending on exploitability in a given environment, but specific evidence for reliable code execution is not available from the provided information.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by disabling SMB multichannel and avoiding use of SMB3 encryption/sealing on affected Linux SMB client systems where operationally feasible, since the reported trigger condition involves multichannel decryption of sealed SMB 3.1.1 traffic. Limit connections to untrusted or unnecessary SMB servers until the kernel is updated. These are risk-reduction measures only and are not substitutes for installing the fixed kernel.

Remediation

Patch, then assume compromise.

Apply a kernel update that includes the fix for CVE-2025-37750. Vendor advisories indicate the issue is resolved in updated Linux kernel packages distributed by affected operating system vendors. On Red Hat Enterprise Linux 9, install the kernel update provided in RHSA-2025:9080 and reboot the system for the fix to take effect. Equivalent vendor-supplied fixed kernel packages should be applied on other affected distributions.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

LinuxLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

redhat accessNews

Jan 1, 2026

RHSA-2025:9080 - Security Advisory - Red Hat Customer Portal

A Linux kernel SMB client use-after-free vulnerability in multichannel decryption handling.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity8