CVE-2025-40328

About vulnerability

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap. A use-after-free flaw was found in the Linux kernel’s SMB client implementation. In smb2_close_cached_fid(), a race condition exists where find_or_create_cached_dir() could acquire a new reference to a cached directory file ID (cfid) after kref_put() observed the reference count drop to zero but before the cfid_list_lock is acquired. This timing gap allows access to freed memory, potentially leading to system instability, data corruption, or privilege escalation.

Live-patch status from KernelCare for each operating system.