CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential UAF in smb2closecachedfid()
findorcreatecacheddir() could grab a new reference after krefput() had seen the refcount drop to zero but before cfidlistlock is acquired in smb2closecachedfid(), leading to use-after-free.
Switch to krefputlock() so cfidrelease() is called with cfidlistlock held, closing that gap.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the Linux kernel fix for the smb client: switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, and adjust smb2_close_cached_fid() to prevent the potential use-after-free described.
Linux kernel (smb client) switch to kref_put_lock() in cfid_release() so cfid_release() is called with cfid_list_lock held = implemented
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40328?
CVE-2025-40328 has a moderate severity level due to its potential for a use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2025-40328?
To fix CVE-2025-40328, update your Linux kernel to the latest version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-40328?
CVE-2025-40328 affects multiple versions of the Linux kernel prior to the patch release for this vulnerability.
What components are impacted by CVE-2025-40328?
CVE-2025-40328 specifically impacts the smb2_close_cached_fid() function within the Linux kernel's SMB client implementation.
Is there a workaround for CVE-2025-40328 if I cannot update?
Currently, no specific workaround is recommended for CVE-2025-40328, so updating the kernel is the best course of action.