CVE-2025-22077

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Revert "smb: client: fix TCP timers deadlock after rmmod"

This reverts commit e9f2517a3e18a54a3943c098d2226b245d488801.

Commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after

rmmod") is intended to fix a null-ptr-deref in LOCKDEP, which is

mentioned as CVE-2024-54680, but is actually did not fix anything;

The issue can be reproduced on top of it. [0]

Also, it reverted the change by commit ef7134c7fc48 ("smb: client:

Fix use-after-free of network namespace.") and introduced a real

issue by reviving the kernel TCP socket.

When a reconnect happens for a CIFS connection, the socket state

transitions to FIN_WAIT_1. Then, inet_csk_clear_xmit_timers_sync()

in tcp_close() stops all timers for the socket.

If an incoming FIN packet is lost, the socket will stay at FIN_WAIT_1

forever, and such sockets could be leaked up to net.ipv4.tcp_max_orphans.

Usually, FIN can be retransmitted by the peer, but if the peer a

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References