Executive brief
A vulnerability in the Linux kernel's virtual file system (VFS) can cause system memory to be 'leaked' or incorrectly held when certain file operations occur on corrupted or busy file systems. This can lead to a 'Busy inodes after unmount' error, potentially preventing clean system shutdowns or causing resource exhaustion over time. The issue primarily affects systems using specific file handle operations, such as those found in network file sharing or specialized industrial controllers.
Technical details
A logic error in the Linux kernel VFS dcache component occurs when `open_by_handle_at()` is called on an uncached inode. If `reconnect_path()` fails to find a dentry during reconnection (due to filesystem corruption or rename races), it creates a new dentry that lacks the `DCACHE_DISCONNECTED` flag even if its parent is disconnected. Following commit f1ee616214cb, which changed how disconnected dentries are reclaimed, these unmarked dentries are not immediately reclaimed by `dput()`, leading to memory leaks and 'Busy inodes after unmount' errors. The fix ensures that the `DCACHE_DISCONNECTED` flag is propagated from parent to child dentries during allocation.
Affected products
- Linux Linux Kernel f1ee616214cb to 56094ad3eaa2
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-10-02: patched: Initial fix authored by Jan Kara
- 2025-10-30: advisory: CVE-2025-40105 published
References
- https://git.kernel.org/stable/c/20863bb7fbb016379f8227122edfabc5c799bc79
- https://git.kernel.org/stable/c/56094ad3eaa21e6621396cc33811d8f72847a834
- https://git.kernel.org/stable/c/620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b
- https://git.kernel.org/stable/c/7e0c8aaf4e28918abded547a5147c7d52c4af7d2
- https://git.kernel.org/stable/c/8004d4b8cbf1bd68a23c160d57287e177c82cc69
- https://git.kernel.org/stable/c/b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4
- https://git.kernel.org/stable/c/cebfbf40056a4d858b2a3ca59a69936d599bd209