{"id":"CVE-2025-40328","state":"PUBLISHED","title":"smb: client: fix potential UAF in smb2_close_cached_fid()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_close_cached_fid()\n\nfind_or_create_cached_dir() could grab a new reference after kref_put()\nhad seen the refcount drop to zero but before cfid_list_lock is acquired\nin smb2_close_cached_fid(), leading to use-after-free.\n\nSwitch to kref_put_lock() so cfid_release() is called with\ncfid_list_lock held, closing that gap.","publishedAt":"2025-12-09T04:09:44.876Z","updatedAt":"2026-10-30T12:23:02.073Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"bb3355ce9dcaba1b4a766f98b2ad373cab6cd626","versionType":"git"},{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"cb52d9c86d70298de0ab7c7953653898cbc0efd6","versionType":"git"},{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"065bd62412271a2d734810dd50336cae88c54427","versionType":"git"},{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"bdb596ceb4b7c3f28786a33840263728217fbcf5","versionType":"git"},{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"734e99623c5b65bf2c03e35978a0b980ebc3c2f8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.117","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.58","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.8","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"]}],"references":["https://git.kernel.org/stable/c/bb3355ce9dcaba1b4a766f98b2ad373cab6cd626","https://git.kernel.org/stable/c/cb52d9c86d70298de0ab7c7953653898cbc0efd6","https://git.kernel.org/stable/c/065bd62412271a2d734810dd50336cae88c54427","https://git.kernel.org/stable/c/bdb596ceb4b7c3f28786a33840263728217fbcf5","https://git.kernel.org/stable/c/734e99623c5b65bf2c03e35978a0b980ebc3c2f8"],"weaknesses":[],"ingestedAt":"2026-10-30T12:40:04.423Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40328.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40328","state":"PUBLISHED","datePublished":"2025-12-09T04:09:44.876Z","dateUpdated":"2026-10-30T12:23:02.073Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.186Z"},"containers":{"cna":{"title":"smb: client: fix potential UAF in smb2_close_cached_fid()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_close_cached_fid()\n\nfind_or_create_cached_dir() could grab a new reference after kref_put()\nhad seen the refcount drop to zero but before cfid_list_lock is acquired\nin smb2_close_cached_fid(), leading to use-after-free.\n\nSwitch to kref_put_lock() so cfid_release() is called with\ncfid_list_lock held, closing that gap."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"bb3355ce9dcaba1b4a766f98b2ad373cab6cd626","versionType":"git"},{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"cb52d9c86d70298de0ab7c7953653898cbc0efd6","versionType":"git"},{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"065bd62412271a2d734810dd50336cae88c54427","versionType":"git"},{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"bdb596ceb4b7c3f28786a33840263728217fbcf5","versionType":"git"},{"version":"ebe98f1447bbccf8228335c62d86af02a0ed23f7","status":"affected","lessThan":"734e99623c5b65bf2c03e35978a0b980ebc3c2f8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.117","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.58","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.8","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/bb3355ce9dcaba1b4a766f98b2ad373cab6cd626"},{"url":"https://git.kernel.org/stable/c/cb52d9c86d70298de0ab7c7953653898cbc0efd6"},{"url":"https://git.kernel.org/stable/c/065bd62412271a2d734810dd50336cae88c54427"},{"url":"https://git.kernel.org/stable/c/bdb596ceb4b7c3f28786a33840263728217fbcf5"},{"url":"https://git.kernel.org/stable/c/734e99623c5b65bf2c03e35978a0b980ebc3c2f8"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The freeing side of the race is driven directly by a remote peer — `smb2_is_valid_lease_break()` (fs/smb/client/smb2misc.c:692) processes unsolicited SMB2 lease-break packets from the server and calls `cached_dir_lease_break()`, which clears the lease ref and queues the final `kref_put()`; server-forced reconnects similarly drive `invalidate_all_cached_dirs()`. A malicious, compromised, or MITM'd SMB server therefore triggers the vulnerable refcount transition over the network.\nAC:L - The attacker controls the timing and rate of lease breaks/reconnects and can replay them indefinitely against routine directory activity on the mount, so the narrow window between `refcount_dec_and_test()` and the lock acquisition can be hit reliably by repetition. Race conditions the attacker can retry at will are Low complexity.\nPR:N - A malicious or MITM SMB server needs no credentials or privileges on the victim host; lease-break notifications are unsolicited server-to-client messages processed by the demultiplex thread. In the local variant the trigger is plain rmdir/stat/readdir on an accessible mount, requiring at most an unprivileged account.\nUI:R - Exploitation requires the victim to have the attacker-controlled SMB share mounted and to be performing directory lookups on it so that `find_or_create_cached_dir()` runs concurrently with the release path. The server cannot force that local access itself.\nS:U - The use-after-free is on a kernel slab object (`struct cached_fid`) and the impact stays within the kernel's own security authority — no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A freed `cached_fid` holding `dentry`, `tcon`, `cifs_fid` handles, a mutex and list/work heads can be reallocated and sprayed with attacker-chosen data; the racing thread then reads it and returns cached directory/file_all_info state, giving a path to disclosing kernel memory. Per guidance, use-after-free is scored High for confidentiality.\nI:H - The stale object is written through as well as read (`kref_get`, `last_access_time`, list manipulation, `dput(cfid->dentry)` on a reused pointer, and `SMB2_close()` on stale fid values), so heap grooming turns this into a write primitive over reallocated slab contents and potential control-flow hijack via the embedded `work_struct` function pointers.\nA:H - Losing the race produces a `refcount_t: addition on 0` warning followed by dereference and double-free of the `cached_fid` — including `dput()` on a freed dentry and slab corruption — reliably causing an oops or kernel panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:23:02.073Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.6.117"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.12.58"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.17.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.18"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-40328","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:59:26.611635Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T22:02:46.047Z"}}]}}}