Skip to main content

Linux Kernel CVE-2025-40320

| EUVDEUVD-2025-201625 CRITICAL
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Requires the client to mount an attacker-controlled SMB server (UI:R) and win a replay/free race (AC:H); primary demonstrated impact is kernel crash/DoS (A:H) with C/I unproven.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.3 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
9.8 (CRITICAL)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201625
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
CRITICAL 9.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential cfid UAF in smb2_query_info_compound

When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free.

Reinitialize cfid to NULL under the replay label.

Example trace (trimmed):

refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110 [...] RIP: 0010:refcount_warn_saturate+0x9c/0x110 [...] Call Trace: <TASK> smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? step_into+0x10d/0x690 ? __legitimize_path+0x28/0x60 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmem_cache_alloc+0x18a/0x340 ? getname_flags+0x46/0x1e0 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfs_by_dentry+0x67/0x90 vfs_statfs+0x16/0xd0 user_statfs+0x54/0xa0 __do_sys_statfs+0x20/0x50 do_syscall_64+0x58/0x80

AnalysisAI

Use-after-free in the Linux kernel's CIFS/SMB client (cifs module) affects the smb2_query_info_compound() function, where a cached fid (cfid) freed during a first attempt is not reset to NULL before a replay, so subsequent cleanup dereferences a stale pointer. Reachable through ordinary filesystem operations such as statfs() against an SMB mount, it manifests as a refcount underflow and use-after-free that most plausibly causes kernel memory corruption and denial of service on hosts with CIFS mounts. This is no public exploit identified at time of analysis; EPSS is very low (0.03%, 7th percentile) and it is not in CISA KEV, though a vendor patch and Ubuntu USN are available.

Technical ContextAI

The affected component is the in-kernel SMB3/CIFS client (fs/smb/client, the 'cifs' module) used by Linux to mount remote Windows/Samba shares. smb2_query_info_compound() batches SMB2 QUERY_INFO operations and, on certain server responses, jumps to a 'replay' label to retry the compound request. A cached directory fid (cfid) allocated on the first pass can be freed during that pass; because the local cfid pointer is not reinitialized to NULL before the retry, the error/cleanup path later operates on the already-freed object. This is a classic use-after-free (CWE-416, though the record lists CWE as N/A) driven by a reference-counter underflow on the cfid, as shown by the 'refcount_t: underflow; use-after-free' warning in the trace via smb2_queryfs → cifs_statfs → __do_sys_statfs. The fix reinitializes cfid to NULL under the replay label so stale state is not reused.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.117, 6.12.58, 6.17.8, or 6.18 (or the fixed version shipped by your distribution). Ubuntu users should apply the kernel update per USN-8095-1 (https://ubuntu.com/security/notices/USN-8095-1) and reboot, or use livepatch where available. Where immediate patching is not possible, reduce exposure by avoiding CIFS/SMB mounts from untrusted or attacker-reachable servers and by unmounting non-essential SMB shares; the trade-off is loss of remote-share functionality on those hosts. Restricting which servers clients may mount (network segmentation/firewalling outbound SMB to only trusted file servers) limits the ability of a malicious server to drive the replay path, at the cost of tighter network policy. The upstream fix is small (reinitialize cfid to NULL at the replay label) and carried in the commits linked above.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40320 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy