CVE-2025-37954

Summary

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Avoid race in open_cached_dir with lease breaks

A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't consider it valid, and thinks it's newly-constructed. This leaks a dentry reference if the allocation occurs before the queued lease break work runs.

Avoid the race by extending holding the cfid_list_lock across find_or_create_cached_dir and when the result is checked.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux81ba10959970d15c388bf29866b01b62f387e6a3 < 2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9affected
LinuxLinux81ba10959970d15c388bf29866b01b62f387e6a3 < 571dcf3d27b24800c171aea7b5e04ff06d10e2e9affected
LinuxLinux81ba10959970d15c388bf29866b01b62f387e6a3 < 2407265dc32bc8cc45b62a612c2a214ba9038e8baffected
LinuxLinux81ba10959970d15c388bf29866b01b62f387e6a3 < 3ca02e63edccb78ef3659bebc68579c7224a6ca2affected
LinuxLinux436be190fbf81e5d84040dabf9cb7be06a94dc5daffected
LinuxLinux6.5.10 < 6.6affected
LinuxLinux6.6affected
LinuxLinux0 < 6.6unaffected
LinuxLinux6.6.91 <= 6.6.*unaffected
LinuxLinux6.12.29 <= 6.12.*unaffected
LinuxLinux6.14.7 <= 6.14.*unaffected
LinuxLinux6.15 <= *unaffected

Weaknesses

References