Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
78c09634f7dc061a3bd09704cdbebb3762a45cdf to < c9e7de284da0be5b44dbe79d71573f9f7f9b144caffected78c09634f7dc061a3bd09704cdbebb3762a45cdf to < 24b9ed739c8c5b464d983e12cf308982f3ae93c2affected78c09634f7dc061a3bd09704cdbebb3762a45cdf to < c9991af5e09924f6f3b3e6996a5e09f9504b4358affected78c09634f7dc061a3bd09704cdbebb3762a45cdf to < 289f945acb20b9b54fe4d13895e44aa58965ddb2affected78c09634f7dc061a3bd09704cdbebb3762a45cdf to < d84291fc7453df7881a970716f8256273aca5747affected
Linux Linux
Default version status: affected
5.13affected0 to < 5.13unaffected6.1.150 to ≤ 6.1.*unaffected6.6.104 to ≤ 6.6.*unaffected6.12.45 to ≤ 6.12.*unaffected6.16.5 to ≤ 6.16.*unaffected6.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c9e7de284da0be5b44dbe79d71573f9f7f9b144c ↗
- https://git.kernel.org/stable/c/24b9ed739c8c5b464d983e12cf308982f3ae93c2 ↗
- https://git.kernel.org/stable/c/c9991af5e09924f6f3b3e6996a5e09f9504b4358 ↗
- https://git.kernel.org/stable/c/289f945acb20b9b54fe4d13895e44aa58965ddb2 ↗
- https://git.kernel.org/stable/c/d84291fc7453df7881a970716f8256273aca5747 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html ↗