CVE-2025-40320: smb: client: fix potential cfid UAF in smb2_query_info_compound
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential cfid UAF in smb2queryinfocompound
When smb2queryinfocompound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free.
Reinitialize cfid to NULL under the replay label.
Example trace (trimmed):
refcountt: underflow; use-after-free. WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcountwarnsaturate+0x9c/0x110 [...] RIP: 0010:refcountwarnsaturate+0x9c/0x110 [...] Call Trace: <TASK> smb2queryinfocompound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? stepinto+0x10d/0x690 ? legitimizepath+0x28/0x60 smb2queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmemcachealloc+0x18a/0x340 ? getnameflags+0x46/0x1e0 cifsstatfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfsbydentry+0x67/0x90 vfsstatfs+0x16/0xd0 userstatfs+0x54/0xa0 dosysstatfs+0x20/0x50 dosyscall64+0x58/0x80
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the kernel CIFS/smb client code so that cfid is reinitialized to NULL under the replay label in smb2_query_info_compound().
Linux kernel CIFS (cifs) client cfid reset on replay = Reinitialize cfid to NULL under the replay label
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40320?
CVE-2025-40320 has been classified with a moderate severity level due to the potential for use-after-free vulnerabilities in the Linux kernel.
How do I fix CVE-2025-40320?
To fix CVE-2025-40320, update the Linux kernel to the latest patched version provided by your distribution.
What systems are affected by CVE-2025-40320?
CVE-2025-40320 affects the Linux Kernel, particularly instances using the SMB client.
What is the primary impact of CVE-2025-40320?
The primary impact of CVE-2025-40320 is the potential for remote code execution due to a use-after-free condition.
When was CVE-2025-40320 disclosed?
CVE-2025-40320 was disclosed as part of ongoing security updates to the Linux kernel.