CVE-2025-38527

HIGH EPSS 4.6%
Published Aug 16, 202510mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Aug 16, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free. Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
4.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 20

VendorProductVersionRange
linuxlinux_kernel*≥3.16.72  –  <3.17
linuxlinux_kernel*≥4.9.171  –  <4.10
linuxlinux_kernel*≥4.14.114  –  <4.15
linuxlinux_kernel*≥4.19.37  –  <4.20
linuxlinux_kernel*≥5.0.10  –  <5.1
linuxlinux_kernel*≥5.1.1  –  <5.15.190
linuxlinux_kernel*≥5.16  –  <6.1.147
linuxlinux_kernel*≥6.2  –  <6.6.100
linuxlinux_kernel*≥6.7  –  <6.12.40
linuxlinux_kernel*≥6.13  –  <6.15.8
linuxlinux_kernel5.1any
linuxlinux_kernel5.1any
linuxlinux_kernel5.1any
linuxlinux_kernel6.16any
linuxlinux_kernel6.16any
linuxlinux_kernel6.16any
linuxlinux_kernel6.16any
linuxlinux_kernel6.16any
linuxlinux_kernel6.16any
debiandebian_linux11.0any

References 7

  • git.kernel.org https://git.kernel.org/stable/c/09bce2138a30ef10d8821c8c3f73a4ab7a5726bc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2baaf5bbab2ac474c4f92c10fcb3310f824db995
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4256a483fe58af66a46cbf3dc48ff26e580d3308
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/705c79101ccf9edea5a00d761491a03ced314210
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/da11bd4b697b393a207f19a2ed7d382a811a3ddc
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
    Mailing ListThird Party Advisory

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/09bce2138a30ef10d8821c8c3f73a4ab7a5726bc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2baaf5bbab2ac474c4f92c10fcb3310f824db995
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4256a483fe58af66a46cbf3dc48ff26e580d3308
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/705c79101ccf9edea5a00d761491a03ced314210
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/da11bd4b697b393a207f19a2ed7d382a811a3ddc
    Patch