Home

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap.

PUBLISHED Reserved 2025-04-16 | Published 2025-12-09 | Updated 2025-12-09 | Assigner Linux

Product status

Default status
unaffected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before cb52d9c86d70298de0ab7c7953653898cbc0efd6
affected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before 065bd62412271a2d734810dd50336cae88c54427
affected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before bdb596ceb4b7c3f28786a33840263728217fbcf5
affected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before 734e99623c5b65bf2c03e35978a0b980ebc3c2f8
affected

Default status
affected

6.1
affected

Any version before 6.1
unaffected

6.6.117 (semver)
unaffected

6.12.58 (semver)
unaffected

6.17.8 (semver)
unaffected

6.18 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/cb52d9c86d70298de0ab7c7953653898cbc0efd6

git.kernel.org/...c/065bd62412271a2d734810dd50336cae88c54427

git.kernel.org/...c/bdb596ceb4b7c3f28786a33840263728217fbcf5

git.kernel.org/...c/734e99623c5b65bf2c03e35978a0b980ebc3c2f8

cve.org (CVE-2025-40328)

nvd.nist.gov (CVE-2025-40328)

Download JSON