Skip to main content

Linux Kernel CVE-2025-68226

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Reached over network only by connecting to a malicious SMB server (AV:N, UI:R), and the UAF is a timing-dependent worker-thread race (AC:H); kernel memory corruption supports high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:20 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix incomplete backport in cfids_invalidation_worker()

The previous commit bdb596ceb4b7 ("smb: client: fix potential UAF in smb2_close_cached_fid()") was an incomplete backport and missed one kref_put() call in cfids_invalidation_worker() that should have been converted to close_cached_dir().

AnalysisAI

Use-after-free in the Linux kernel's SMB/CIFS client (cifs module) arises from an incomplete backport of commit bdb596ceb4b7, which left a stale kref_put() call in cfids_invalidation_worker() instead of converting it to close_cached_dir(). The flaw affects the cached-directory (cfid) invalidation path used when a Linux system mounts remote SMB shares, and with a CVSS of 8.8 (C:H/I:H/A:H) could allow memory corruption leading to information disclosure or code execution. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%).

Technical ContextAI

The vulnerability lives in the in-kernel SMB client (fs/smb/client, historically 'cifs'), specifically in the cached-directory handle machinery. The kernel caches open directory handles (cfids) to speed up repeated metadata operations against an SMB2/3 server; these are reference-counted via kref. The parent fix (bdb596ceb4b7, 'fix potential UAF in smb2_close_cached_fid()') moved from a raw kref_put() to the higher-level close_cached_dir() helper to safely tear down cached handles, but this stable-tree backport missed the corresponding kref_put() in cfids_invalidation_worker() - the worker that invalidates cached directory entries. The unconverted put can drop the final reference and free the cfid while another path still uses it, producing a classic use-after-free (root cause class CWE-416, though the record lists CWE as N/A). Because this is a backport gap, only stable branches that received the partial backport are affected, not necessarily mainline.

Affected ProductsAI

The affected component is the Linux kernel SMB/CIFS client module (fs/smb/client). The specific defect exists in stable kernel branches that received the incomplete backport of commit bdb596ceb4b7; the exact affected version ranges are not enumerated in the provided data (no CPE strings were supplied). The upstream corrective commit is published at the kernel stable git tree: https://git.kernel.org/stable/c/abd29b6e17a918fdd68352ce4813e167acc8727e . Systems that mount remote SMB shares using the in-kernel cifs client are the exposed surface.

RemediationAI

Upstream fix available (commit abd29b6e17a918fdd68352ce4813e167acc8727e); a released, tagged patched kernel version is not independently confirmed from the provided data - apply the stable-kernel update from your distribution once it lands, or backport the referenced commit (https://git.kernel.org/stable/c/abd29b6e17a918fdd68352ce4813e167acc8727e), which restores the close_cached_dir() call in cfids_invalidation_worker(). As a compensating control until patched, avoid mounting SMB/CIFS shares from untrusted or attacker-controllable servers and restrict outbound SMB (TCP 445) to known-good file servers, since exploitation requires the client to interact with a hostile server; where the cifs client is not needed, unload/blacklist the module (modprobe -r cifs / blacklist) to remove the attack surface entirely, at the cost of losing SMB mount capability. These controls reduce exposure but do not fix the underlying race.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68226 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy