CVE-2025-38244

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix potential deadlock when reconnecting channels<br /> <br /> Fix cifs_signal_cifsd_for_reconnect() to take the correct lock order<br /> and prevent the following deadlock from happening<br /> <br /> ======================================================<br /> WARNING: possible circular locking dependency detected<br /> 6.16.0-rc3-build2+ #1301 Tainted: G S W<br /> ------------------------------------------------------<br /> cifsd/6055 is trying to acquire lock:<br /> ffff88810ad56038 (&amp;tcp_ses-&gt;srv_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x134/0x200<br /> <br /> but task is already holding lock:<br /> ffff888119c64330 (&amp;ret_buf-&gt;chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200<br /> <br /> which lock already depends on the new lock.<br /> <br /> the existing dependency chain (in reverse order) is:<br /> <br /> -&gt; #2 (&amp;ret_buf-&gt;chan_lock){+.+.}-{3:3}:<br /> validate_chain+0x1cf/0x270<br /> __lock_acquire+0x60e/0x780<br /> lock_acquire.part.0+0xb4/0x1f0<br /> _raw_spin_lock+0x2f/0x40<br /> cifs_setup_session+0x81/0x4b0<br /> cifs_get_smb_ses+0x771/0x900<br /> cifs_mount_get_session+0x7e/0x170<br /> cifs_mount+0x92/0x2d0<br /> cifs_smb3_do_mount+0x161/0x460<br /> smb3_get_tree+0x55/0x90<br /> vfs_get_tree+0x46/0x180<br /> do_new_mount+0x1b0/0x2e0<br /> path_mount+0x6ee/0x740<br /> do_mount+0x98/0xe0<br /> __do_sys_mount+0x148/0x180<br /> do_syscall_64+0xa4/0x260<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> <br /> -&gt; #1 (&amp;ret_buf-&gt;ses_lock){+.+.}-{3:3}:<br /> validate_chain+0x1cf/0x270<br /> __lock_acquire+0x60e/0x780<br /> lock_acquire.part.0+0xb4/0x1f0<br /> _raw_spin_lock+0x2f/0x40<br /> cifs_match_super+0x101/0x320<br /> sget+0xab/0x270<br /> cifs_smb3_do_mount+0x1e0/0x460<br /> smb3_get_tree+0x55/0x90<br /> vfs_get_tree+0x46/0x180<br /> do_new_mount+0x1b0/0x2e0<br /> path_mount+0x6ee/0x740<br /> do_mount+0x98/0xe0<br /> __do_sys_mount+0x148/0x180<br /> do_syscall_64+0xa4/0x260<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> <br /> -&gt; #0 (&amp;tcp_ses-&gt;srv_lock){+.+.}-{3:3}:<br /> check_noncircular+0x95/0xc0<br /> check_prev_add+0x115/0x2f0<br /> validate_chain+0x1cf/0x270<br /> __lock_acquire+0x60e/0x780<br /> lock_acquire.part.0+0xb4/0x1f0<br /> _raw_spin_lock+0x2f/0x40<br /> cifs_signal_cifsd_for_reconnect+0x134/0x200<br /> __cifs_reconnect+0x8f/0x500<br /> cifs_handle_standard+0x112/0x280<br /> cifs_demultiplex_thread+0x64d/0xbc0<br /> kthread+0x2f7/0x310<br /> ret_from_fork+0x2a/0x230<br /> ret_from_fork_asm+0x1a/0x30<br /> <br /> other info that might help us debug this:<br /> <br /> Chain exists of:<br /> &amp;tcp_ses-&gt;srv_lock --&gt; &amp;ret_buf-&gt;ses_lock --&gt; &amp;ret_buf-&gt;chan_lock<br /> <br /> Possible unsafe locking scenario:<br /> <br /> CPU0 CPU1<br /> ---- ----<br /> lock(&amp;ret_buf-&gt;chan_lock);<br /> lock(&amp;ret_buf-&gt;ses_lock);<br /> lock(&amp;ret_buf-&gt;chan_lock);<br /> lock(&amp;tcp_ses-&gt;srv_lock);<br /> <br /> *** DEADLOCK ***<br /> <br /> 3 locks held by cifsd/6055:<br /> #0: ffffffff857de398 (&amp;cifs_tcp_ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x7b/0x200<br /> #1: ffff888119c64060 (&amp;ret_buf-&gt;ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x9c/0x200<br /> #2: ffff888119c64330 (&amp;ret_buf-&gt;chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200