Executive brief
A vulnerability exists in the Linux kernel's SMB client, which is used to connect to network file shares. A race condition in how the system manages cached directory information could allow an attacker to cause a system crash or potentially execute unauthorized code. This affects the reliability and security of systems that mount remote SMB/CIFS file systems.
Technical details
A use-after-free (UAF) vulnerability exists in fs/smb/client/cached_dir.c within the Linux kernel. The flaw is rooted in a race condition where find_or_create_cached_dir() could increment a reference count after kref_put() has already initiated the destruction process but before the cfid_list_lock is acquired in smb2_close_cached_fid(). This allows a thread to access a cached file ID (cfid) object that is being freed. The fix involves migrating to kref_put_lock() to ensure the release callback is executed while holding the necessary spinlock, thereby atomizing the check and release operations. This issue affects SMB client implementations using directory leases.
Affected products
- Linux Linux Kernel 6.1 to 6.1.117, 6.6 to 6.6.58, 6.12 to 6.12.8, 6.17 to 6.17.8
Timeline
- 2025-12-09: disclosed
- 2025-12-09: advisory