{"id":"CVE-2025-37954","state":"PUBLISHED","title":"smb: client: Avoid race in open_cached_dir with lease breaks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Avoid race in open_cached_dir with lease breaks\n\nA pre-existing valid cfid returned from find_or_create_cached_dir might\nrace with a lease break, meaning open_cached_dir doesn't consider it\nvalid, and thinks it's newly-constructed. This leaks a dentry reference\nif the allocation occurs before the queued lease break work runs.\n\nAvoid the race by extending holding the cfid_list_lock across\nfind_or_create_cached_dir and when the result is checked.","publishedAt":"2025-05-20T16:01:48.561Z","updatedAt":"2026-10-15T21:52:05.057Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","status":"affected","lessThan":"2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9","versionType":"git"},{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","status":"affected","lessThan":"571dcf3d27b24800c171aea7b5e04ff06d10e2e9","versionType":"git"},{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","status":"affected","lessThan":"2407265dc32bc8cc45b62a612c2a214ba9038e8b","versionType":"git"},{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","status":"affected","lessThan":"3ca02e63edccb78ef3659bebc68579c7224a6ca2","versionType":"git"},{"version":"436be190fbf81e5d84040dabf9cb7be06a94dc5d","status":"affected","versionType":"git"},{"version":"6.5.10","status":"affected","lessThan":"6.6","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.91","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.29","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.7","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"]}],"references":["https://git.kernel.org/stable/c/2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9","https://git.kernel.org/stable/c/571dcf3d27b24800c171aea7b5e04ff06d10e2e9","https://git.kernel.org/stable/c/2407265dc32bc8cc45b62a612c2a214ba9038e8b","https://git.kernel.org/stable/c/3ca02e63edccb78ef3659bebc68579c7224a6ca2"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/37xxx/CVE-2025-37954.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-37954","state":"PUBLISHED","datePublished":"2025-05-20T16:01:48.561Z","dateUpdated":"2026-10-15T21:52:05.057Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:23.973Z"},"containers":{"cna":{"title":"smb: client: Avoid race in open_cached_dir with lease breaks","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Avoid race in open_cached_dir with lease breaks\n\nA pre-existing valid cfid returned from find_or_create_cached_dir might\nrace with a lease break, meaning open_cached_dir doesn't consider it\nvalid, and thinks it's newly-constructed. This leaks a dentry reference\nif the allocation occurs before the queued lease break work runs.\n\nAvoid the race by extending holding the cfid_list_lock across\nfind_or_create_cached_dir and when the result is checked."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","status":"affected","lessThan":"2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9","versionType":"git"},{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","status":"affected","lessThan":"571dcf3d27b24800c171aea7b5e04ff06d10e2e9","versionType":"git"},{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","status":"affected","lessThan":"2407265dc32bc8cc45b62a612c2a214ba9038e8b","versionType":"git"},{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","status":"affected","lessThan":"3ca02e63edccb78ef3659bebc68579c7224a6ca2","versionType":"git"},{"version":"436be190fbf81e5d84040dabf9cb7be06a94dc5d","status":"affected","versionType":"git"},{"version":"6.5.10","status":"affected","lessThan":"6.6","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.91","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.29","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.7","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9"},{"url":"https://git.kernel.org/stable/c/571dcf3d27b24800c171aea7b5e04ff06d10e2e9"},{"url":"https://git.kernel.org/stable/c/2407265dc32bc8cc45b62a612c2a214ba9038e8b"},{"url":"https://git.kernel.org/stable/c/3ca02e63edccb78ef3659bebc68579c7224a6ca2"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The race is driven by an unsolicited SMB2 lease-break packet from the remote server, dispatched straight from the cifs demultiplex thread into cached_dir_lease_break() (fs/smb/client/smb2misc.c:655) with no pending request. A malicious/compromised SMB server, or an off-path attacker injecting frames on an unsigned SMB connection, controls exactly when that half of the race fires.\nAC:L - The attacker controls both sides — the server chooses when and how often to send lease breaks (unlimited retries, one per re-cached directory), while the client's routine stat()/getdents() traffic, which the server can itself provoke by breaking leases to force re-opens, repeatedly traverses the unlocked window. The same class of race in this file was reproduced by its author with two ordinary shell loops.\nPR:N - The attacking SMB server holds no privileges or credentials on the victim client; it merely answers a share the client has already mounted. The local half needs nothing beyond stat() or readdir() on the mount, available to any unprivileged account with no capabilities.\nUI:N - The mount is a pre-existing configuration, not an exploit-time action, and no deliberate victim participation is needed — ordinary background directory access from any process supplies the local half, and the server can force re-opens on demand by breaking the lease.\nS:U - The leaked dentry/inode references, corrupted superblock teardown and crash are all confined to the client kernel's own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:N - The defect is a lost reference count; no memory is read out of bounds and no kernel data is copied to the attacker. The only pointer surfaced is in a WARN message, which is %p-hashed and requires dmesg access.\nI:N - The attacker gains no write primitive — nothing attacker-controlled is stored anywhere, and the cfid kref accounting remains balanced in every interleaving I traced, so no double-free or type confusion is reachable.\nA:H - Each won race permanently leaks a dentry, its inode and an open server handle, and the affected mount can never be torn down: unmount hits WARN(1, \"BUG: Dentry ... still in use\") in umount_check() and then \"VFS: Busy inodes after unmount\", which is a hard BUG()/oops under CONFIG_BUG_ON_DATA_CORRUPTION and a panic under panic_on_warn. Otherwise the superblock is freed with live VFS_PTR_POISON'd inodes that crash on any later access, on top of unbounded, unreclaimable memory growth."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:58:37.074Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.29"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.14.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-37954","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T21:46:24.590387Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:52:05.057Z"}}]}}}