Executive brief
A vulnerability exists in the Linux kernel's SMB server (ksmbd), which is used to share files over a network. Due to a technical error in how the system handles file deletion requests, a race condition can occur when multiple users or processes attempt to open, close, or delete the same file simultaneously. This can result in files failing to delete when they should or disappearing unexpectedly while still in use, potentially leading to data inconsistency or unauthorized file persistence.
Technical details
A data race exists in the ksmbd module within the Linux kernel due to inconsistent locking of the 'm_flags' field in 'ksmbd_inode'. While some code paths accessed this field under 'ci->m_lock', others (such as ksmbd_inode_pending_delete and ksmbd_fd_set_delete_on_close) did not, leading to a race condition during concurrent file operations. An attacker or concurrent processes could trigger this race to cause 'delete-on-close' or 'pending-delete' bits to be lost or observed in an inconsistent state. This results in incorrect VFS semantics where files may persist on disk after a requested deletion or be unlinked while still active. The fix unifies locking by ensuring all reads and modifications of 'm_flags' occur under the 'ci->m_lock' protection.
Affected products
- Linux Linux Kernel 5.15 to 6.18.3
Timeline
- 2026-01-13: disclosed: CVE-2025-68809 was published
- 2026-01-11: patched: Fix committed to stable kernel tree