{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39825","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.140Z","datePublished":"2025-09-16T13:00:23.897Z","dateUpdated":"2026-08-05T12:05:27.067Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:05:27.067Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix race with concurrent opens in rename(2)\n\nBesides sending the rename request to the server, the rename process\nalso involves closing any deferred close, waiting for outstanding I/O\nto complete as well as marking all existing open handles as deleted to\nprevent them from deferring closes, which increases the race window\nfor potential concurrent opens on the target file.\n\nFix this by unhashing the dentry in advance to prevent any concurrent\nopens on the target."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The race is driven entirely by local syscalls — one thread in `rename(2)`/`renameat2(2)` reaching `cifs_rename2()` and another in `open(2)` hitting the still-hashed target dentry via `lookup_fast()`. No network peer initiates the attack; a remote SMB server can only widen the window by delaying responses.\nAC:L - The attacker owns both sides of the race and the window is enormous — it spans an unbounded `netfs_wait_for_outstanding_io()` wait, deferred-close teardown, and a full SMB round trip plus a 3-iteration retry loop. The attacker can widen it arbitrarily by keeping I/O outstanding on the target, making it trivially winnable with a simple rename/open loop.\nPR:L - Any unprivileged local user with ordinary access to a directory on an already-mounted CIFS/SMB share can call rename(2) and open(2); no capabilities are required. Mounted SMB shares are routine on enterprise desktops, autofs home directories, and containers with CIFS volumes.\nUI:N - Both racing threads are the attacker's own; no victim action is needed. The presence of an SMB mount is a standing system configuration, not a per-exploit user interaction.\nS:U - The corruption of dcache/deferred-handle state and the resulting file damage stay entirely within the kernel and the mounted filesystem's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A handle opened inside the race escapes `cifs_mark_open_handles_for_deleted_file()` and remains on `tcon->openFileList`, where `cifs_get_readable_path()` matches cached handles by path string — so a later `open(2)`/`read(2)` of that path can be served from the stale handle to the pre-rename file, disclosing unbounded contents of a file (potentially another user's) that should no longer be reachable at that name.\nI:H - The racing open makes the target appear busy, driving `cifs_rename2()` into the `unlink_target:` path that deletes the target file and retries — on retry failure the file's data is destroyed while rename(2) reports an error (the documented data-loss mode fixed by the later `c5ea3065586d`). The same stale path-matched handle also lets writes land on the wrong server-side object.\nA:H - By keeping opens and I/O active on the still-hashed target, the attacker prevents `netfs_wait_for_outstanding_io()`'s `io_count` from ever reaching zero, pinning the renaming task in unkillable uninterruptible sleep while it holds the parent directory's `i_rwsem` exclusively — starving all other operations in that directory and triggering hung-task warnings (panic with `hung_task_panic=1`)."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/inode.c"],"versions":[{"version":"78c09634f7dc061a3bd09704cdbebb3762a45cdf","lessThan":"c9e7de284da0be5b44dbe79d71573f9f7f9b144c","status":"affected","versionType":"git"},{"version":"78c09634f7dc061a3bd09704cdbebb3762a45cdf","lessThan":"24b9ed739c8c5b464d983e12cf308982f3ae93c2","status":"affected","versionType":"git"},{"version":"78c09634f7dc061a3bd09704cdbebb3762a45cdf","lessThan":"c9991af5e09924f6f3b3e6996a5e09f9504b4358","status":"affected","versionType":"git"},{"version":"78c09634f7dc061a3bd09704cdbebb3762a45cdf","lessThan":"289f945acb20b9b54fe4d13895e44aa58965ddb2","status":"affected","versionType":"git"},{"version":"78c09634f7dc061a3bd09704cdbebb3762a45cdf","lessThan":"d84291fc7453df7881a970716f8256273aca5747","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/inode.c"],"versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","status":"unaffected","versionType":"semver"},{"version":"6.1.150","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.104","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.45","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.5","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.1.150"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.6.104"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.12.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.16.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c9e7de284da0be5b44dbe79d71573f9f7f9b144c"},{"url":"https://git.kernel.org/stable/c/24b9ed739c8c5b464d983e12cf308982f3ae93c2"},{"url":"https://git.kernel.org/stable/c/c9991af5e09924f6f3b3e6996a5e09f9504b4358"},{"url":"https://git.kernel.org/stable/c/289f945acb20b9b54fe4d13895e44aa58965ddb2"},{"url":"https://git.kernel.org/stable/c/d84291fc7453df7881a970716f8256273aca5747"}],"title":"smb: client: fix race with concurrent opens in rename(2)","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:43:46.244Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:07:20.499Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","versions":[{"status":"affected","version":"0","lessThan":"V5.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-39825","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-06-10T20:41:27.081852Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-11T18:44:12.510Z"}}]}}