Double Free Vulnerability in Linux Kernel CIFS Client

CVE-2025-21673

Summary

A vulnerability has been identified in the CIFS client of the Linux Kernel, where a double free scenario occurs due to improper management of the TCP_Server_Info::hostname during server shutdown. In the cifs_put_tcp_session() function, if the cifsd thread attempts to reconnect to multiple DFS targets, it may not realize it should exit the loop, leading to potential memory corruption. This can result in critical errors and application crashes, emphasizing the importance of applying patches and updates to maintain system security.

References