CVE-2025-39825

smb: client: fix race with concurrent opens in rename(2)

State: Published
Severity: 7.8 High
Published: Sep 16, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix race with concurrent opens in rename(2)

Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file.

Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	78c09634f7dc061a3bd09704cdbebb3762a45cdf to before c9e7de284da0be5b44dbe79d71573f9f7f9b144cAffected 78c09634f7dc061a3bd09704cdbebb3762a45cdf to before 24b9ed739c8c5b464d983e12cf308982f3ae93c2Affected 78c09634f7dc061a3bd09704cdbebb3762a45cdf to before c9991af5e09924f6f3b3e6996a5e09f9504b4358Affected 78c09634f7dc061a3bd09704cdbebb3762a45cdf to before 289f945acb20b9b54fe4d13895e44aa58965ddb2Affected 78c09634f7dc061a3bd09704cdbebb3762a45cdf to before d84291fc7453df7881a970716f8256273aca5747Affected
LinuxLinux	5.13Affected before 5.13Not affected 6.1.150 through 6.1.Not affected 6.6.104 through 6.6.Not affected 6.12.45 through 6.12.Not affected 6.16.5 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

78c09634f7dc061a3bd09704cdbebb3762a45cdf to before c9e7de284da0be5b44dbe79d71573f9f7f9b144cAffected
78c09634f7dc061a3bd09704cdbebb3762a45cdf to before 24b9ed739c8c5b464d983e12cf308982f3ae93c2Affected
78c09634f7dc061a3bd09704cdbebb3762a45cdf to before c9991af5e09924f6f3b3e6996a5e09f9504b4358Affected
78c09634f7dc061a3bd09704cdbebb3762a45cdf to before 289f945acb20b9b54fe4d13895e44aa58965ddb2Affected
78c09634f7dc061a3bd09704cdbebb3762a45cdf to before d84291fc7453df7881a970716f8256273aca5747Affected

LinuxLinux

5.13Affected
before 5.13Not affected
6.1.150 through 6.1.*Not affected
6.6.104 through 6.6.*Not affected
6.12.45 through 6.12.*Not affected
6.16.5 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.