CVE-2025-37954 (GCVE-0-2025-37954)

Vulnerability from cvelistv5 – Published: 2025-05-20 16:01 – Updated: 2026-08-05 11:58
VLAI
Title
smb: client: Avoid race in open_cached_dir with lease breaks
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't consider it valid, and thinks it's newly-constructed. This leaks a dentry reference if the allocation occurs before the queued lease break work runs. Avoid the race by extending holding the cfid_list_lock across find_or_create_cached_dir and when the result is checked.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 81ba10959970d15c388bf29866b01b62f387e6a3 , < 2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9 (git)
Affected: 81ba10959970d15c388bf29866b01b62f387e6a3 , < 571dcf3d27b24800c171aea7b5e04ff06d10e2e9 (git)
Affected: 81ba10959970d15c388bf29866b01b62f387e6a3 , < 2407265dc32bc8cc45b62a612c2a214ba9038e8b (git)
Affected: 81ba10959970d15c388bf29866b01b62f387e6a3 , < 3ca02e63edccb78ef3659bebc68579c7224a6ca2 (git)
Affected: 436be190fbf81e5d84040dabf9cb7be06a94dc5d (git)
Affected: 6.5.10 , < 6.6 (semver)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.91 , ≤ 6.6.* (semver)
Unaffected: 6.12.29 , ≤ 6.12.* (semver)
Unaffected: 6.14.7 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cached_dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9",
              "status": "affected",
              "version": "81ba10959970d15c388bf29866b01b62f387e6a3",
              "versionType": "git"
            },
            {
              "lessThan": "571dcf3d27b24800c171aea7b5e04ff06d10e2e9",
              "status": "affected",
              "version": "81ba10959970d15c388bf29866b01b62f387e6a3",
              "versionType": "git"
            },
            {
              "lessThan": "2407265dc32bc8cc45b62a612c2a214ba9038e8b",
              "status": "affected",
              "version": "81ba10959970d15c388bf29866b01b62f387e6a3",
              "versionType": "git"
            },
            {
              "lessThan": "3ca02e63edccb78ef3659bebc68579c7224a6ca2",
              "status": "affected",
              "version": "81ba10959970d15c388bf29866b01b62f387e6a3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "436be190fbf81e5d84040dabf9cb7be06a94dc5d",
              "versionType": "git"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cached_dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.91",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.29",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.7",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Avoid race in open_cached_dir with lease breaks\n\nA pre-existing valid cfid returned from find_or_create_cached_dir might\nrace with a lease break, meaning open_cached_dir doesn\u0027t consider it\nvalid, and thinks it\u0027s newly-constructed. This leaks a dentry reference\nif the allocation occurs before the queued lease break work runs.\n\nAvoid the race by extending holding the cfid_list_lock across\nfind_or_create_cached_dir and when the result is checked."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The race is driven by an unsolicited SMB2 lease-break packet from the remote server, dispatched straight from the cifs demultiplex thread into cached_dir_lease_break() (fs/smb/client/smb2misc.c:655) with no pending request. A malicious/compromised SMB server, or an off-path attacker injecting frames on an unsigned SMB connection, controls exactly when that half of the race fires.\nAC:L - The attacker controls both sides \u2014 the server chooses when and how often to send lease breaks (unlimited retries, one per re-cached directory), while the client\u0027s routine stat()/getdents() traffic, which the server can itself provoke by breaking leases to force re-opens, repeatedly traverses the unlocked window. The same class of race in this file was reproduced by its author with two ordinary shell loops.\nPR:N - The attacking SMB server holds no privileges or credentials on the victim client; it merely answers a share the client has already mounted. The local half needs nothing beyond stat() or readdir() on the mount, available to any unprivileged account with no capabilities.\nUI:N - The mount is a pre-existing configuration, not an exploit-time action, and no deliberate victim participation is needed \u2014 ordinary background directory access from any process supplies the local half, and the server can force re-opens on demand by breaking the lease.\nS:U - The leaked dentry/inode references, corrupted superblock teardown and crash are all confined to the client kernel\u0027s own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:N - The defect is a lost reference count; no memory is read out of bounds and no kernel data is copied to the attacker. The only pointer surfaced is in a WARN message, which is %p-hashed and requires dmesg access.\nI:N - The attacker gains no write primitive \u2014 nothing attacker-controlled is stored anywhere, and the cfid kref accounting remains balanced in every interleaving I traced, so no double-free or type confusion is reachable.\nA:H - Each won race permanently leaks a dentry, its inode and an open server handle, and the affected mount can never be torn down: unmount hits WARN(1, \"BUG: Dentry ... still in use\") in umount_check() and then \"VFS: Busy inodes after unmount\", which is a hard BUG()/oops under CONFIG_BUG_ON_DATA_CORRUPTION and a panic under panic_on_warn. Otherwise the superblock is freed with live VFS_PTR_POISON\u0027d inodes that crash on any later access, on top of unbounded, unreclaimable memory growth."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:37.074Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9"
        },
        {
          "url": "https://git.kernel.org/stable/c/571dcf3d27b24800c171aea7b5e04ff06d10e2e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2407265dc32bc8cc45b62a612c2a214ba9038e8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ca02e63edccb78ef3659bebc68579c7224a6ca2"
        }
      ],
      "title": "smb: client: Avoid race in open_cached_dir with lease breaks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37954",
    "datePublished": "2025-05-20T16:01:48.561Z",
    "dateReserved": "2025-04-16T04:51:23.973Z",
    "dateUpdated": "2026-08-05T11:58:37.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37954",
      "date": "2026-08-05",
      "epss": "0.00298",
      "percentile": "0.22013"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:05:04.000Z",
      "cve": "CVE-2025-37954",
      "id": "msrc_CVE-2025-37954",
      "initial_release_date": "2025-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: Avoid race in open_cached_dir with lease breaks",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-37954.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37954\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:33.603\",\"lastModified\":\"2026-07-30T06:22:37.017\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: Avoid race in open_cached_dir with lease breaks\\n\\nA pre-existing valid cfid returned from find_or_create_cached_dir might\\nrace with a lease break, meaning open_cached_dir doesn\u0027t consider it\\nvalid, and thinks it\u0027s newly-constructed. This leaks a dentry reference\\nif the allocation occurs before the queued lease break work runs.\\n\\nAvoid the race by extending holding the cfid_list_lock across\\nfind_or_create_cached_dir and when the result is checked.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: Evitar la competencia en open_cached_dir con interrupciones de arrendamiento. Un cfid v\u00e1lido preexistente devuelto desde find_or_create_cached_dir podr\u00eda competir con una interrupci\u00f3n de arrendamiento, lo que significa que open_cached_dir no lo considera v\u00e1lido y cree que es de nueva construcci\u00f3n. Esto filtra una referencia de dentry si la asignaci\u00f3n ocurre antes de que se ejecute el trabajo de interrupci\u00f3n de arrendamiento en cola. Evite la competencia extendiendo la retenci\u00f3n de cfid_list_lock a trav\u00e9s de find_or_create_cached_dir y cuando se comprueba el resultado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/cached_dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"81ba10959970d15c388bf29866b01b62f387e6a3\",\"lessThan\":\"2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"81ba10959970d15c388bf29866b01b62f387e6a3\",\"lessThan\":\"571dcf3d27b24800c171aea7b5e04ff06d10e2e9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"81ba10959970d15c388bf29866b01b62f387e6a3\",\"lessThan\":\"2407265dc32bc8cc45b62a612c2a214ba9038e8b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"81ba10959970d15c388bf29866b01b62f387e6a3\",\"lessThan\":\"3ca02e63edccb78ef3659bebc68579c7224a6ca2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"436be190fbf81e5d84040dabf9cb7be06a94dc5d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.5.10\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/cached_dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.91\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.29\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.7\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.91\",\"matchCriteriaId\":\"196ED05D-3404-4E71-B4B1-894BED1228FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.29\",\"matchCriteriaId\":\"7215ABCF-8EB1-46CD-8872-8BCE4890E579\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.7\",\"matchCriteriaId\":\"5715A6F5-A34A-4B27-8A64-82825E963995\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2407265dc32bc8cc45b62a612c2a214ba9038e8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3ca02e63edccb78ef3659bebc68579c7224a6ca2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/571dcf3d27b24800c171aea7b5e04ff06d10e2e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:22:56+00:00",
      "cve": "CVE-2025-37954",
      "id": "CVE-2025-37954",
      "initial_release_date": "2025-05-20T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: Avoid race in open_cached_dir with lease breaks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37954.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-17T13:12:25Z",
      "cve": "CVE-2025-37954",
      "id": "CVE-2025-37954",
      "initial_release_date": "2025-05-21T00:46:25Z",
      "product_status:known_affected": "567",
      "product_status:known_not_affected": "148",
      "product_status:recommended": "407",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37954",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37954.json",
      "version": "41"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.