{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-37954","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:23.973Z","datePublished":"2025-05-20T16:01:48.561Z","dateUpdated":"2026-08-05T11:58:37.074Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:58:37.074Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Avoid race in open_cached_dir with lease breaks\n\nA pre-existing valid cfid returned from find_or_create_cached_dir might\nrace with a lease break, meaning open_cached_dir doesn't consider it\nvalid, and thinks it's newly-constructed. This leaks a dentry reference\nif the allocation occurs before the queued lease break work runs.\n\nAvoid the race by extending holding the cfid_list_lock across\nfind_or_create_cached_dir and when the result is checked."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The race is driven by an unsolicited SMB2 lease-break packet from the remote server, dispatched straight from the cifs demultiplex thread into cached_dir_lease_break() (fs/smb/client/smb2misc.c:655) with no pending request. A malicious/compromised SMB server, or an off-path attacker injecting frames on an unsigned SMB connection, controls exactly when that half of the race fires.\nAC:L - The attacker controls both sides — the server chooses when and how often to send lease breaks (unlimited retries, one per re-cached directory), while the client's routine stat()/getdents() traffic, which the server can itself provoke by breaking leases to force re-opens, repeatedly traverses the unlocked window. The same class of race in this file was reproduced by its author with two ordinary shell loops.\nPR:N - The attacking SMB server holds no privileges or credentials on the victim client; it merely answers a share the client has already mounted. The local half needs nothing beyond stat() or readdir() on the mount, available to any unprivileged account with no capabilities.\nUI:N - The mount is a pre-existing configuration, not an exploit-time action, and no deliberate victim participation is needed — ordinary background directory access from any process supplies the local half, and the server can force re-opens on demand by breaking the lease.\nS:U - The leaked dentry/inode references, corrupted superblock teardown and crash are all confined to the client kernel's own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:N - The defect is a lost reference count; no memory is read out of bounds and no kernel data is copied to the attacker. The only pointer surfaced is in a WARN message, which is %p-hashed and requires dmesg access.\nI:N - The attacker gains no write primitive — nothing attacker-controlled is stored anywhere, and the cfid kref accounting remains balanced in every interleaving I traced, so no double-free or type confusion is reachable.\nA:H - Each won race permanently leaks a dentry, its inode and an open server handle, and the affected mount can never be torn down: unmount hits WARN(1, \"BUG: Dentry ... still in use\") in umount_check() and then \"VFS: Busy inodes after unmount\", which is a hard BUG()/oops under CONFIG_BUG_ON_DATA_CORRUPTION and a panic under panic_on_warn. Otherwise the superblock is freed with live VFS_PTR_POISON'd inodes that crash on any later access, on top of unbounded, unreclaimable memory growth."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"],"versions":[{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","lessThan":"2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9","status":"affected","versionType":"git"},{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","lessThan":"571dcf3d27b24800c171aea7b5e04ff06d10e2e9","status":"affected","versionType":"git"},{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","lessThan":"2407265dc32bc8cc45b62a612c2a214ba9038e8b","status":"affected","versionType":"git"},{"version":"81ba10959970d15c388bf29866b01b62f387e6a3","lessThan":"3ca02e63edccb78ef3659bebc68579c7224a6ca2","status":"affected","versionType":"git"},{"version":"436be190fbf81e5d84040dabf9cb7be06a94dc5d","status":"affected","versionType":"git"},{"version":"6.5.10","lessThan":"6.6","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cached_dir.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.91","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.29","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.14.7","lessThanOrEqual":"6.14.*","status":"unaffected","versionType":"semver"},{"version":"6.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.29"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.14.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5.10"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9"},{"url":"https://git.kernel.org/stable/c/571dcf3d27b24800c171aea7b5e04ff06d10e2e9"},{"url":"https://git.kernel.org/stable/c/2407265dc32bc8cc45b62a612c2a214ba9038e8b"},{"url":"https://git.kernel.org/stable/c/3ca02e63edccb78ef3659bebc68579c7224a6ca2"}],"title":"smb: client: Avoid race in open_cached_dir with lease breaks","x_generator":{"engine":"bippy-1.2.0"}}}}