CVE-2025-68226 (GCVE-0-2025-68226)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:57 – Updated: 2026-08-05 12:10
VLAI
Title
smb: client: fix incomplete backport in cfids_invalidation_worker()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix incomplete backport in cfids_invalidation_worker() The previous commit bdb596ceb4b7 ("smb: client: fix potential UAF in smb2_close_cached_fid()") was an incomplete backport and missed one kref_put() call in cfids_invalidation_worker() that should have been converted to close_cached_dir().
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bdb596ceb4b7c3f28786a33840263728217fbcf5 , < abd29b6e17a918fdd68352ce4813e167acc8727e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17.8 , < 6.17.10 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cached_dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "abd29b6e17a918fdd68352ce4813e167acc8727e",
              "status": "affected",
              "version": "bdb596ceb4b7c3f28786a33840263728217fbcf5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cached_dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.17.10",
              "status": "affected",
              "version": "6.17.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.17.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix incomplete backport in cfids_invalidation_worker()\n\nThe previous commit bdb596ceb4b7 (\"smb: client: fix potential UAF in\nsmb2_close_cached_fid()\") was an incomplete backport and missed one\nkref_put() call in cfids_invalidation_worker() that should have been\nconverted to close_cached_dir()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable SMB client path is driven by a remote SMB peer: a malicious server can grant a cached directory lease and then force a session loss and reconnect that reaches the invalidation worker. This requires only network access to the established client connection.\nAC:L - The server controls the lease grant, connection failure or session-expired response, and reconnect timing, while the worker commonly holds the final lease reference. Triggering the lock and preemption imbalance therefore requires no uncontrollable race.\nPR:N - The remote SMB peer needs no privileges on the client and can accept guest or supplied credentials. Although mounting CIFS normally requires victim-side CAP_SYS_ADMIN, that is a deployment and user-interaction prerequisite rather than an attacker privilege.\nUI:R - A victim or administrator must mount or otherwise connect to the SMB share, which can create the cached root-directory handle. The remote peer can subsequently trigger the flaw without further interaction.\nS:U - The vulnerable cached-directory worker and resulting impacts reside within the same Linux kernel security authority. This does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The unpaired spin unlock can release cfid_list_lock while another CPU owns it, allowing concurrent cached-fid list and lifetime operations to cause use-after-free or heap corruption. Conservatively, that corruption can expose arbitrary kernel memory.\nI:H - Breaking cfid_list_lock serialization permits concurrent list-pointer and object-lifetime writes, potentially producing exploitable kernel heap corruption and control-flow modification. This supports arbitrary modification or kernel code execution.\nA:H - The flaw underflows the worker\u0027s preemption state when the final reference is dropped, producing workqueue atomic-state and scheduling failures. It can panic, hang, or otherwise destabilize the kernel and is repeatable by the remote SMB peer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:10:18.178Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/abd29b6e17a918fdd68352ce4813e167acc8727e"
        }
      ],
      "title": "smb: client: fix incomplete backport in cfids_invalidation_worker()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68226",
    "datePublished": "2025-12-16T13:57:19.268Z",
    "dateReserved": "2025-12-16T13:41:40.257Z",
    "dateUpdated": "2026-08-05T12:10:18.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68226",
      "date": "2026-09-22",
      "epss": "0.00351",
      "percentile": "0.28864"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/cached_dir.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "abd29b6e17a918fdd68352ce4813e167acc8727e",
                    "status": "affected",
                    "version": "bdb596ceb4b7c3f28786a33840263728217fbcf5",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/cached_dir.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6.17.10",
                    "status": "affected",
                    "version": "6.17.8",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix incomplete backport in cfids_invalidation_worker()\n\nThe previous commit bdb596ceb4b7 (\"smb: client: fix potential UAF in\nsmb2_close_cached_fid()\") was an incomplete backport and missed one\nkref_put() call in cfids_invalidation_worker() that should have been\nconverted to close_cached_dir()."
          }
        ],
        "id": "CVE-2025-68226",
        "lastModified": "2026-07-30T06:24:33.917",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-16T14:15:56.040",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/abd29b6e17a918fdd68352ce4813e167acc8727e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:34:04+00:00",
      "cve": "CVE-2025-68226",
      "id": "CVE-2025-68226",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel SMB client: Denial of Service due to Use-After-Free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68226.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:43:26Z",
      "cve": "CVE-2025-68226",
      "id": "CVE-2025-68226",
      "initial_release_date": "2025-12-17T00:25:00Z",
      "product_status:known_not_affected": "525",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68226",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68226.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.