Skip to main content

Linux Kernel CVE-2025-40328

HIGH
2025-12-09 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Client-side race triggered via a malicious SMB server the victim connects to, so UI:R and AC:H for the timing window; UAF can yield high C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:38 vuln.today
CVE Published
Dec 09, 2025 - 16:17 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_close_cached_fid()

find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free.

Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap.

AnalysisAI

Use-after-free in the Linux kernel's SMB client (cifs) cached-directory handling lets a race between find_or_create_cached_dir() and smb2_close_cached_fid() free a cfid object while a new reference is being taken, corrupting kernel memory on a host mounting an SMB/CIFS share. The flaw is a reference-counting gap fixed by switching to kref_put_lock() so cfid_release() runs under cfid_list_lock. No public exploit identified at time of analysis, EPSS is low (0.20%, 11th percentile), and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the in-kernel SMB3/CIFS client (fs/smb/client), specifically the cached-directory (cfid) subsystem that keeps open handles to frequently accessed directories to reduce round-trips. Reference lifetime is managed with the kernel's kref API. The root cause is a classic use-after-free (CWE-416) driven by a time-of-check/time-of-use race: kref_put() in smb2_close_cached_fid() observed the refcount reach zero, but before cfid_list_lock was acquired, find_or_create_cached_dir() grabbed a fresh reference to the same object, so the subsequent release operated on memory that could already be in flux. The fix uses kref_put_lock(), which atomically drops the final reference and invokes the release callback with the lock already held, eliminating the window. The four git.kernel.org references are the upstream/stable commits carrying this fix across maintained kernel branches.

Affected ProductsAI

The Linux kernel SMB/CIFS client (fs/smb/client, cifs.ko) is affected; the CVE record does not enumerate exact version ranges and no CPE strings were provided in the intelligence, so precise vulnerable/fixed kernel versions must be derived from the four stable-tree commits (065bd624, 734e9962, bdb596ce, cb52d9c8 at git.kernel.org). Any distribution kernel that includes the cached-directory (cfid) feature in the SMB client and predates backport of these commits should be considered potentially affected. Authoritative fix references: https://git.kernel.org/stable/c/065bd62412271a2d734810dd50336cae88c54427 , https://git.kernel.org/stable/c/734e99623c5b65bf2c03e35978a0b980ebc3c2f8 , https://git.kernel.org/stable/c/bdb596ceb4b7c3f28786a33840263728217fbcf5 , https://git.kernel.org/stable/c/cb52d9c86d70298de0ab7c7953653898cbc0efd6 .

RemediationAI

Apply the upstream fix that replaces kref_put() with kref_put_lock() in smb2_close_cached_fid(); an upstream fix is available (stable-tree commits/patches), but no single tagged release version is stated in the input, so consumers should update to their distribution's kernel build that incorporates commits 065bd624/734e9962/bdb596ce/cb52d9c8 (see the four git.kernel.org URLs) and confirm the backport with their vendor. On stable/LTS branches, take the corresponding maintainer-tagged point release once your distribution ships it. As a compensating control where patching is delayed, avoid mounting SMB/CIFS shares from untrusted or attacker-influenced servers and restrict which hosts a client may connect to (firewall egress on TCP/445 to known-good file servers); this reduces exposure to a malicious server that could try to drive the race, at the cost of blocking ad-hoc SMB usage. Disabling the cifs module entirely on hosts that do not need SMB client functionality removes the attack surface but breaks any SMB mounts those hosts rely on.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40328 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy