Skip to content
OpenAdvisories
High · 8.8 CVE-2022-48919 EUVD-2022-53798GHSA-j96q-j829-h7g8

cifs: fix double free race when mount fails in cifs_get_root()

Published Aug 22, 2024 · Updated Aug 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia-6.2 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix double free race when mount fails in cifs_get_root()

When cifs_get_root() fails during cifs_smb3_do_mount() we call
deactivate_locked_super() which eventually will call delayed_free() which
will free the context.
In this situation we should not proceed to enter the out: section in
cifs_smb3_do_mount() and free the same resources a second time.

[Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60
[Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0

[Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G OE 5.17.0-rc3+ #4
[Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019
[Thu Feb 10 12:59:06 2022] Call Trace:
[Thu Feb 10 12:59:06 2022] <IRQ>
[Thu Feb 10 12:59:06 2022] dump_stack_lvl+0x5d/0x78
[Thu Feb 10 12:59:06 2022] print_address_description.constprop.0+0x24/0x150
[Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60
[Thu Feb 10 12:59:06 2022] kasan_report.cold+0x7d/0x117
[Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60
[Thu Feb 10 12:59:06 2022] __asan_load8+0x86/0xa0
[Thu Feb 10 12:59:06 2022] rcu_cblist_dequeue+0x32/0x60
[Thu Feb 10 12:59:06 2022] rcu_core+0x547/0xca0
[Thu Feb 10 12:59:06 2022] ? call_rcu+0x3c0/0x3c0
[Thu Feb 10 12:59:06 2022] ? __this_cpu_preempt_check+0x13/0x20
[Thu Feb 10 12:59:06 2022] ? lock_is_held_type+0xea/0x140
[Thu Feb 10 12:59:06 2022] rcu_core_si+0xe/0x10
[Thu Feb 10 12:59:06 2022] __do_softirq+0x1d4/0x67b
[Thu Feb 10 12:59:06 2022] __irq_exit_rcu+0x100/0x150
[Thu Feb 10 12:59:06 2022] irq_exit_rcu+0xe/0x30
[Thu Feb 10 12:59:06 2022] sysvec_hyperv_stimer0+0x9d/0xc0
...
[Thu Feb 10 12:59:07 2022] Freed by task 58179:
[Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50
[Thu Feb 10 12:59:07 2022] kasan_set_track+0x25/0x30
[Thu Feb 10 12:59:07 2022] kasan_set_free_info+0x24/0x40
[Thu Feb 10 12:59:07 2022] ____kasan_slab_free+0x137/0x170
[Thu Feb 10 12:59:07 2022] __kasan_slab_free+0x12/0x20
[Thu Feb 10 12:59:07 2022] slab_free_freelist_hook+0xb3/0x1d0
[Thu Feb 10 12:59:07 2022] kfree+0xcd/0x520
[Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0x149/0xbe0 [cifs]
[Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs]
[Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140
[Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0
[Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210
[Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0
[Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae

[Thu Feb 10 12:59:07 2022] Last potentially related work creation:
[Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50
[Thu Feb 10 12:59:07 2022] __kasan_record_aux_stack+0xb6/0xc0
[Thu Feb 10 12:59:07 2022] kasan_record_aux_stack_noalloc+0xb/0x10
[Thu Feb 10 12:59:07 2022] call_rcu+0x76/0x3c0
[Thu Feb 10 12:59:07 2022] cifs_umount+0xce/0xe0 [cifs]
[Thu Feb 10 12:59:07 2022] cifs_kill_sb+0xc8/0xe0 [cifs]
[Thu Feb 10 12:59:07 2022] deactivate_locked_super+0x5d/0xd0
[Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0xab9/0xbe0 [cifs]
[Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs]
[Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140
[Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0
[Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210
[Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0
[Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae

Affected products

VendorProductAffectedFixed
Linux Linux 5.11 5.15.27

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 5.16.14-1 —
Debian 13 linux 5.16.14-1 —
Debian 12 linux 5.16.14-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-raspi-realtime No fix yet —
Ubuntu 22.04 LTS linux-riscv +31 No fix yet —
Ubuntu 20.04 LTS linux-gke +26 No fix yet —
Ubuntu 20.04 LTS linux-gkeop 5.4.0-1046.48 —
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1008.11~20.04.1 —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
ReleasePackageFixed inAdvisory
RHEL 8 kernel-rt +12 4.18.0-553.58.1.rt7.399.el8_10 RHSA-2025:9581
RHEL 8 perf +26 4.18.0-553.58.1.el8_10 RHSA-2025:9580

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 kernel-rt +9 4.18.0-553.58.1.rt7.399.el8_10 ALSA-2025:9581
AlmaLinux 8 perf +24 4.18.0-553.58.1.el8_10 ALSA-2025:9580

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 kernel 4.18.0-553.58.1.el8_10 RLSA-2025:9580
Rocky Linux 8 kernel-rt 4.18.0-553.58.1.rt7.399.el8_10 RLSA-2025:9581
ReleasePackageFixed inAdvisory
SLES 15 SP5 kernel-64kb +4 5.14.21-150500.55.80.2 SUSE-SU-2024:3483-1
SLES 15 SP5 kernel-azure +2 5.14.21-150500.33.66.1 SUSE-SU-2024:3190-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.80.2.150500.6.35.6 SUSE-SU-2024:3483-1
SLES 15 SP5 kernel-syms +1 5.14.21-150500.55.80.1 SUSE-SU-2024:3483-1
SLES 15 SP4 kernel-64kb +4 5.14.21-150400.24.133.2 SUSE-SU-2024:3408-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.133.2.150400.24.64.5 SUSE-SU-2024:3408-1
SLES 15 SP4 kernel-docs +1 5.14.21-150400.24.133.1 SUSE-SU-2024:3408-1
SLES 15 SP3 kernel-64kb +7 5.3.18-150300.59.174.1 SUSE-SU-2024:3249-1
SLES 15 SP3 kernel-default-base 5.3.18-150300.59.174.1.150300.18.103.1 SUSE-SU-2024:3249-1
SLES 15 SP2 kernel-default-base 5.3.18-150200.24.203.1.150200.9.105.1 SUSE-SU-2024:3499-1
SLES 15 SP2 kernel-docs +5 5.3.18-150200.24.203.1 SUSE-SU-2024:3499-1
SLES 12 SP5 kernel-azure +2 4.12.14-16.197.1 SUSE-SU-2024:3252-1
SLES 12 SP5 kernel-docs +1 4.12.14-122.228.2 SUSE-SU-2024:3251-1
SLES 12 SP5 kernel-syms +2 4.12.14-122.228.1 SUSE-SU-2024:3251-1
Show 23 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 11 SP4 kernel-ec2 +5 3.0.101-108.162.1 SUSE-SU-2024:3467-1
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.133.2.150400.24.64.5 SUSE-SU-2024:3408-1
SLES for SAP 15 SP4 kernel-docs +1 5.14.21-150400.24.133.1 SUSE-SU-2024:3408-1
SLES for SAP 15 SP4 kernel-source +2 5.14.21-150400.24.133.2 SUSE-SU-2024:3408-1
SLES for SAP 15 SP3 kernel-default-base 5.3.18-150300.59.174.1.150300.18.103.1 SUSE-SU-2024:3249-1
SLES for SAP 15 SP3 kernel-docs +5 5.3.18-150300.59.174.1 SUSE-SU-2024:3249-1
SLES for SAP 15 SP2 kernel-default-base 5.3.18-150200.24.203.1.150200.9.105.1 SUSE-SU-2024:3499-1
SLES for SAP 15 SP2 kernel-docs +5 5.3.18-150200.24.203.1 SUSE-SU-2024:3499-1
SLES for SAP 12 SP5 kernel-azure +2 4.12.14-16.197.1 SUSE-SU-2024:3252-1
SLES for SAP 12 SP5 kernel-syms +2 4.12.14-122.228.1 SUSE-SU-2024:3251-1
SLE Real Time 12 SP5 kernel-rt +3 4.12.14-10.200.1 SUSE-SU-2024:3189-1
SLE Micro 5.5 kernel-default 5.14.21-150500.55.80.2 SUSE-SU-2024:3483-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.80.2.150500.6.35.6 SUSE-SU-2024:3483-1
SLE Micro 5.5 kernel-rt +1 5.14.21-150500.13.67.3 SUSE-SU-2024:3209-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.133.2 SUSE-SU-2024:3408-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.133.2.150400.24.64.5 SUSE-SU-2024:3408-1
SLE Micro 5.4 kernel-rt +1 5.14.21-150400.15.91.3 SUSE-SU-2024:3227-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.133.2 SUSE-SU-2024:3408-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.133.2.150400.24.64.5 SUSE-SU-2024:3408-1
SLE Micro 5.3 kernel-rt +1 5.14.21-150400.15.91.3 SUSE-SU-2024:3227-1
SLE Micro 5.2 kernel-default 5.3.18-150300.59.174.1 SUSE-SU-2024:3249-1
SLE Micro 5.2 kernel-default-base 5.3.18-150300.59.174.1.150300.18.103.1 SUSE-SU-2024:3249-1
SLE Micro 5.2 kernel-rt +1 5.3.18-150300.181.2 SUSE-SU-2024:3225-1
SLE Micro 5.1 kernel-default 5.3.18-150300.59.174.1 SUSE-SU-2024:3249-1
SLE Micro 5.1 kernel-default-base 5.3.18-150300.59.174.1.150300.18.103.1 SUSE-SU-2024:3249-1
SLE Micro 5.1 kernel-rt +1 5.3.18-150300.181.2 SUSE-SU-2024:3225-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.80.2 SUSE-SU-2024:3483-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_19 +1 1-150500.11.3.2 SUSE-SU-2024:3483-1, SUSE-SU-2024:3209-1
SLE Live Patching 15 SP4 kernel-default 5.14.21-150400.24.133.2 SUSE-SU-2024:3408-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_31 1-150400.9.3.2 SUSE-SU-2024:3408-1
SLE Live Patching 15 SP3 kernel-default 5.3.18-150300.59.174.1 SUSE-SU-2024:3249-1
SLE Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_48 1-150300.7.3.1 SUSE-SU-2024:3249-1
SLE Live Patching 15 SP2 kernel-default 5.3.18-150200.24.203.1 SUSE-SU-2024:3499-1
SLE Live Patching 15 SP2 kernel-livepatch-SLE15-SP2_Update_52 1-150200.5.3.1 SUSE-SU-2024:3499-1
SLE Live Patching 12 SP5 kernel-default 4.12.14-122.228.1 SUSE-SU-2024:3251-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_60 1-8.3.1 SUSE-SU-2024:3251-1
SLE HPC 15 SP4 kernel-64kb +3 5.14.21-150400.24.133.2 SUSE-SU-2024:3408-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.133.2.150400.24.64.5 SUSE-SU-2024:3408-1
SLE HPC 15 SP4 kernel-docs +1 5.14.21-150400.24.133.1 SUSE-SU-2024:3408-1
SLE HPC 15 SP3 kernel-64kb +6 5.3.18-150300.59.174.1 SUSE-SU-2024:3249-1
SLE HPC 15 SP3 kernel-default-base 5.3.18-150300.59.174.1.150300.18.103.1 SUSE-SU-2024:3249-1
SLE HPC 15 SP2 kernel-default-base 5.3.18-150200.24.203.1.150200.9.105.1 SUSE-SU-2024:3499-1
SLE HPC 15 SP2 kernel-docs +5 5.3.18-150200.24.203.1 SUSE-SU-2024:3499-1
SUSE Real Time Module 15 SP5 kernel-rt +2 5.14.21-150500.13.67.3 SUSE-SU-2024:3209-1
SUSE Real Time Module 15 SP5 kernel-syms-rt 5.14.21-150500.13.67.1 SUSE-SU-2024:3209-1
SUSE Manager Server 4.3 kernel-default-base 5.14.21-150400.24.133.2.150400.24.64.5 SUSE-SU-2024:3408-1
SUSE Manager Server 4.3 kernel-source +2 5.14.21-150400.24.133.2 SUSE-SU-2024:3408-1
SUSE Manager Server 4.3 kernel-syms 5.14.21-150400.24.133.1 SUSE-SU-2024:3408-1
SUSE Manager Proxy 4.3 kernel-default-base 5.14.21-150400.24.133.2.150400.24.64.5 SUSE-SU-2024:3408-1
SUSE Manager Proxy 4.3 kernel-source +1 5.14.21-150400.24.133.2 SUSE-SU-2024:3408-1
SUSE Manager Proxy 4.3 kernel-syms 5.14.21-150400.24.133.1 SUSE-SU-2024:3408-1
SUSE Enterprise Storage 7.1 kernel-64kb +6 5.3.18-150300.59.174.1 SUSE-SU-2024:3249-1
SUSE Enterprise Storage 7.1 kernel-default-base 5.3.18-150300.59.174.1.150300.18.103.1 SUSE-SU-2024:3249-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 dtb-aarch64 +3 5.14.21-150500.55.80.1 SUSE-SU-2024:3483-1
openSUSE Leap 15.5 kernel-64kb +6 5.14.21-150500.55.80.2 SUSE-SU-2024:3483-1
openSUSE Leap 15.5 kernel-azure +2 5.14.21-150500.33.66.1 SUSE-SU-2024:3190-1
openSUSE Leap 15.5 kernel-default-base 5.14.21-150500.55.80.2.150500.6.35.6 SUSE-SU-2024:3483-1
openSUSE Leap 15.5 kernel-rt +2 5.14.21-150500.13.67.3 SUSE-SU-2024:3209-1
openSUSE Leap 15.5 kernel-syms-rt 5.14.21-150500.13.67.1 SUSE-SU-2024:3209-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.5 kernel-default 5.14.21-150500.55.80.2 SUSE-SU-2024:3483-1
openSUSE Leap Micro 5.5 kernel-default-base 5.14.21-150500.55.80.2.150500.6.35.6 SUSE-SU-2024:3483-1
openSUSE Leap Micro 5.5 kernel-rt 5.14.21-150500.13.67.3 SUSE-SU-2024:3209-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 kernel-livepatch-4.14.273-207.502 1.0-0.amzn2 ALAS2-2022-1768
Amazon Linux 2 perf +8 4.14.273-207.502.amzn2 ALAS2-2022-1768

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 perf +19 4.18.0-553.58.1.el8_10 ELSA-2025-9580

Advisories 23

References