Skip to main content

Linux Kernel CVE-2025-40328

HIGH
2025-12-09 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure host to mount malicious SMB share
  2. Delivery
    Trigger rapid cached-dir open/close
  3. Exploit
    Win refcount race in cfid
  4. Execution
    Access freed cfid object
  5. Impact
    Kernel memory corruption or crash

Vulnerability Assessment

Exploitation Conditions

Exploitation requires the target host to be running a vulnerable Linux kernel SMB client and to be actively using the cached-directory (cfid) feature against an SMB/CIFS server that the attacker controls or can influence, so that concurrent find_or_create_cached_dir() and smb2_close_cached_fid() operations execute on the same cfid - i.e., the victim must mount/connect to a hostile SMB share (this is the UI:R factor). Exploitation is limited by the need to win a narrow timing race (making it probabilistic and unreliable), by the requirement for attacker-influenced SMB server interaction rather than a purely unauthenticated remote push, and by the absence of any public exploit; a host that never mounts untrusted SMB shares is effectively not exposed.
Impact

Signals conflict and should be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H = 8.8) implies an easily triggered network-reachable flaw, but the description makes clear this is a concurrency race in the SMB *client*, which realistically requires the victim to mount or interact with a malicious/compromised SMB server, and race windows are non-trivial to win - so AC:L understates true exploitation difficulty (AC:H is more defensible). EPSS is low (0.20%, 11th percentile), there is no KEV listing and no public exploit, consistent with a hard-to-weaponize kernel race rather than a mass-exploited bug. The 'Information Disclosure' tag is narrower than the CVSS C:H/I:H/A:H; a UAF can in principle yield info leak, DoS (crash), or memory corruption, but reliable code execution from this specific race is speculative. Net: real but not urgent for most environments - prioritize on hosts that mount untrusted SMB shares; treat the 8.8 as inflated relative to practical exploitability.
Exploit ScenarioDerived

A host is induced to mount or repeatedly access a directory on an SMB share controlled or influenced by an attacker; by driving rapid concurrent open/close operations on a cached directory handle, the attacker attempts to win the reference-counting race so the cfid object is freed and then reused. Success could crash the kernel (DoS) or, with precise heap grooming, corrupt memory for potential privilege escalation. No public proof-of-concept exists at time of analysis, and reliably winning the race in practice is difficult.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Use-after-free in the Linux kernel's SMB client (cifs) cached-directory handling lets a race between find_or_create_cached_dir() and smb2_close_cached_fid() free a cfid object while a new reference is being taken, corrupting kernel memory on a host mounting an SMB/CIFS share. The flaw is a reference-counting gap fixed by switching to kref_put_lock() so cfid_release() runs under cfid_list_lock. No public exploit identified at time of analysis, EPSS is low (0.20%, 11th percentile), and it is not listed in CISA KEV.

RemediationAI

Apply the upstream fix that replaces kref_put() with kref_put_lock() in smb2_close_cached_fid(); an upstream fix is available (stable-tree commits/patches), but no single tagged release version is stated in the input, so consumers should update to their distribution's kernel build that incorporates commits 065bd624/734e9962/bdb596ce/cb52d9c8 (see the four git.kernel.org URLs) and confirm the backport with their vendor. On stable/LTS branches, take the corresponding maintainer-tagged point release once your distribution ships it. As a compensating control where patching is delayed, avoid mounting SMB/CIFS shares from untrusted or attacker-influenced servers and restrict which hosts a client may connect to (firewall egress on TCP/445 to known-good file servers); this reduces exposure to a malicious server that could try to drive the race, at the cost of blocking ad-hoc SMB usage. Disabling the cifs module entirely on hosts that do not need SMB client functionality removes the attack surface but breaks any SMB mounts those hosts rely on.

Affected ProductsAI

The Linux kernel SMB/CIFS client (fs/smb/client, cifs.ko) is affected; the CVE record does not enumerate exact version ranges and no CPE strings were provided in the intelligence, so precise vulnerable/fixed kernel versions must be derived from the four stable-tree commits (065bd624, 734e9962, bdb596ce, cb52d9c8 at git.kernel.org). Any distribution kernel that includes the cached-directory (cfid) feature in the SMB client and predates backport of these commits should be considered potentially affected. Authoritative fix references: https://git.kernel.org/stable/c/065bd62412271a2d734810dd50336cae88c54427 , https://git.kernel.org/stable/c/734e99623c5b65bf2c03e35978a0b980ebc3c2f8 , https://git.kernel.org/stable/c/bdb596ceb4b7c3f28786a33840263728217fbcf5 , https://git.kernel.org/stable/c/cb52d9c86d70298de0ab7c7953653898cbc0efd6 .

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the in-kernel SMB3/CIFS client (fs/smb/client), specifically the cached-directory (cfid) subsystem that keeps open handles to frequently accessed directories to reduce round-trips. Reference lifetime is managed with the kernel's kref API. The root cause is a classic use-after-free (CWE-416) driven by a time-of-check/time-of-use race: kref_put() in smb2_close_cached_fid() observed the refcount reach zero, but before cfid_list_lock was acquired, find_or_create_cached_dir() grabbed a fresh reference to the same object, so the subsequent release operated on memory that could already be in flux. The fix uses kref_put_lock(), which atomically drops the final reference and invokes the release callback with the lock already held, eliminating the window. The four git.kernel.org references are the upstream/stable commits carrying this fix across maintained kernel branches.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 7.5 HIGH

Client-side race triggered via a malicious SMB server the victim connects to, so UI:R and AC:H for the timing window; UAF can yield high C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_close_cached_fid()

find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free.

Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap.

Executive ViewAI

Why It Matters

CVE-2025-40328 is a use-after-free vulnerability in the Linux kernel's SMB/CIFS client that could enable kernel memory corruption on systems mounting SMB shares. With a CVSS score of 8.8 and no vendor-released patch currently available, this unpatched high-severity vulnerability poses elevated risk to dependent infrastructure, though exploitation likelihood remains low (EPSS 0.2%, no public exploit identified at time of analysis).

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict SMB share access via network firewalls and segmentation to trusted internal networks only; (2) Disable CIFS services on systems where not operationally required; (3) Enable kernel crash dumps and configure centralized monitoring for memory corruption or kernel panic events; (4) Maintain current security patch levels on all other kernel subsystems and OS components; (5) Implement strict access controls on all SMB shares to limit exposure to authenticated users.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Prevalence
Ubiquitous
Linux kernel with in-tree SMB/CIFS client on vast numbers of hosts
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/334915 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0293/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0447/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0472/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0587/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20207/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20220/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20228/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20498/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20564/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ REF https://git.kernel.org/stable/c/065bd62412271a2d734810dd50336cae88c54427 REF https://git.kernel.org/stable/c/734e99623c5b65bf2c03e35978a0b980ebc3c2f8 REF https://git.kernel.org/stable/c/bb3355ce9dcaba1b4a766f98b2ad373cab6cd626 REF https://git.kernel.org/stable/c/bdb596ceb4b7c3f28786a33840263728217fbcf5 REF https://git.kernel.org/stable/c/cb52d9c86d70298de0ab7c7953653898cbc0efd6

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy