Executive brief
A vulnerability exists in the Linux kernel's SMB client, which is used to connect to network file shares. An error in how the system handles cached directory information could lead to a 'use-after-free' condition, potentially causing system instability or allowing unauthorized access to data. This issue was caused by an incomplete software update and has been resolved in newer kernel versions.
Technical details
This vulnerability is a use-after-free (UAF) in the Linux kernel SMB client (cifs) component. The root cause is an incomplete backport of a previous fix (commit bdb596ceb4b7), which failed to replace a kref_put() call with close_cached_dir() in the cfids_invalidation_worker() function within fs/smb/client/cached_dir.c. An attacker could potentially exploit this memory management error to cause a kernel crash or achieve arbitrary code execution. The vulnerability is reachable via network-based SMB interactions. A patch has been released in the stable Linux kernel tree (commit abd29b6e17a9).
Affected products
- Linux Linux Kernel 6.17.8 to 6.17.10
Timeline
- 2025-11-26: disclosed: Initial patch authored
- 2025-12-01: patched: Patch committed to stable tree
- 2025-12-16: advisory: CVE published