CVE-2025-38051

Q: What is the severity of CVE-2025-38051?

CVE-2025-38051 has a CVSS score of 7.0 (HIGH). A use-after-free vulnerability in the Linux kernel's CIFS client implementation allows an attacker to trigger memory corruption during concurrent directory read operations. This affects systems using CIFS/SMB file shares with the vulnerable kernel versions. The vulnerability can lead to system crashes or potential privilege escalation.

7.0 HIGH

Denial of Service

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's CIFS client implementation allows an attacker to trigger memory corruption during concurrent directory read operations. This affects systems using CIFS/SMB file shares with the vulnerable kernel versions. The vulnerability can lead to system crashes or potential privilege escalation.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before fixes in stable trees (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with CIFS/SMB client enabled and in use. The vulnerability is triggered during concurrent readdir operations.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or potential privilege escalation to kernel-level code execution.

🟠

Likely Case

System crash or kernel panic causing denial of service on affected systems.

🟢

If Mitigated

Limited to denial of service if exploit fails or system has additional memory protection mechanisms.

🌐 Internet-Facing: MEDIUM - Requires CIFS/SMB access which is often internal but could be exposed via VPN or misconfiguration.

🏢 Internal Only: HIGH - Internal attackers with access to CIFS shares can trigger the vulnerability.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploit requires access to trigger concurrent directory operations on CIFS shares. POC is available according to the CVE description.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits: 1b197931fbc821bc7e9e91bf619400db563e3338, 73cadde98f67f76c5eba00ac0b72c453383cec8b, 9bea368648ac46f8593a780760362e40291d22a9, 9c9aafbacc183598f064902365e107b5e856531f, a24c2f05ac3c5b0aaa539d9d913826d2643dfd0e

Vendor Advisory: https://git.kernel.org/stable/c/1b197931fbc821bc7e9e91bf619400db563e3338

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable CIFS module

linux

Prevent loading of CIFS kernel module to eliminate attack surface

echo 'blacklist cifs' > /etc/modprobe.d/blacklist-cifs.conf
rmmod cifs

Restrict CIFS mount access

linux

Limit which users can mount CIFS shares to reduce attack surface

chmod 700 /sbin/mount.cifs
setfacl -m u:root:rwx /sbin/mount.cifs

🧯 If You Can't Patch

Implement network segmentation to isolate CIFS/SMB traffic
Monitor for unusual directory listing activity on CIFS shares

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if CIFS module is loaded: uname -r && lsmod | grep cifs

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and test concurrent directory operations on CIFS mounts

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
KASAN reports in dmesg
CIFS error messages in system logs

Network Indicators:

Unusual high-frequency directory listing requests to CIFS shares

SIEM Query:

source="kernel" AND ("KASAN" OR "use-after-free" OR "cifs_fill_dirent")

📊 Metadata

CVE ID: CVE-2025-38051

CVSS v3 Score: 7.0 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (5.3th percentile)

Published: June 18, 2025

Last Updated: January 12, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable CIFS module

Restrict CIFS mount access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities