CVE-2025-40328

smb: client: fix potential UAF in smb2_close_cached_fid()

State: Published
Severity: 8.8 High
Published: Dec 9, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_close_cached_fid()

find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free.

Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before bb3355ce9dcaba1b4a766f98b2ad373cab6cd626Affected ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before cb52d9c86d70298de0ab7c7953653898cbc0efd6Affected ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 065bd62412271a2d734810dd50336cae88c54427Affected ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before bdb596ceb4b7c3f28786a33840263728217fbcf5Affected ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 734e99623c5b65bf2c03e35978a0b980ebc3c2f8Affected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.191 through 6.1.Not affected 6.6.117 through 6.6.Not affected 6.12.58 through 6.12.Not affected 6.17.8 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before bb3355ce9dcaba1b4a766f98b2ad373cab6cd626Affected
ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before cb52d9c86d70298de0ab7c7953653898cbc0efd6Affected
ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 065bd62412271a2d734810dd50336cae88c54427Affected
ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before bdb596ceb4b7c3f28786a33840263728217fbcf5Affected
ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 734e99623c5b65bf2c03e35978a0b980ebc3c2f8Affected

LinuxLinux

6.1Affected
before 6.1Not affected
6.1.191 through 6.1.*Not affected
6.6.117 through 6.6.*Not affected
6.12.58 through 6.12.*Not affected
6.17.8 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.