CVE-2025-21673
A flaw in the Linux kernel's SMB client allows for a 'double free' error during server shutdown. This occurs when the system attempts to release the same memory for a hostname twice, leading to system instability.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running Linux kernel version 6.13 are affected by this vulnerability.
Real-world impact
An attacker could potentially cause a system crash or trigger unpredictable behavior by exploiting how the kernel manages memory during network reconnection attempts.
Why this severity
The critical score reflects that this vulnerability can be exploited remotely over a network without requiring special privileges or user interaction, potentially leading to a complete loss of system integrity and availability.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for the smb: client double free of TCP_Server_Info::hostname.
NVD-referenced vendor advisory
Timeline
- Jan 31, 2025 · Jan 31, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.