CVE-2025-39825 (GCVE-0-2025-39825)

Vulnerability from cvelistv5 – Published: 2025-09-16 13:00 – Updated: 2026-08-05 12:05
VLAI
Title
smb: client: fix race with concurrent opens in rename(2)
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 78c09634f7dc061a3bd09704cdbebb3762a45cdf , < c9e7de284da0be5b44dbe79d71573f9f7f9b144c (git)
Affected: 78c09634f7dc061a3bd09704cdbebb3762a45cdf , < 24b9ed739c8c5b464d983e12cf308982f3ae93c2 (git)
Affected: 78c09634f7dc061a3bd09704cdbebb3762a45cdf , < c9991af5e09924f6f3b3e6996a5e09f9504b4358 (git)
Affected: 78c09634f7dc061a3bd09704cdbebb3762a45cdf , < 289f945acb20b9b54fe4d13895e44aa58965ddb2 (git)
Affected: 78c09634f7dc061a3bd09704cdbebb3762a45cdf , < d84291fc7453df7881a970716f8256273aca5747 (git)
Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 6.1.150 , ≤ 6.1.* (semver)
Unaffected: 6.6.104 , ≤ 6.6.* (semver)
Unaffected: 6.12.45 , ≤ 6.12.* (semver)
Unaffected: 6.16.5 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:46.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:07:20.499Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39825",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:27.081852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:12.510Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c9e7de284da0be5b44dbe79d71573f9f7f9b144c",
              "status": "affected",
              "version": "78c09634f7dc061a3bd09704cdbebb3762a45cdf",
              "versionType": "git"
            },
            {
              "lessThan": "24b9ed739c8c5b464d983e12cf308982f3ae93c2",
              "status": "affected",
              "version": "78c09634f7dc061a3bd09704cdbebb3762a45cdf",
              "versionType": "git"
            },
            {
              "lessThan": "c9991af5e09924f6f3b3e6996a5e09f9504b4358",
              "status": "affected",
              "version": "78c09634f7dc061a3bd09704cdbebb3762a45cdf",
              "versionType": "git"
            },
            {
              "lessThan": "289f945acb20b9b54fe4d13895e44aa58965ddb2",
              "status": "affected",
              "version": "78c09634f7dc061a3bd09704cdbebb3762a45cdf",
              "versionType": "git"
            },
            {
              "lessThan": "d84291fc7453df7881a970716f8256273aca5747",
              "status": "affected",
              "version": "78c09634f7dc061a3bd09704cdbebb3762a45cdf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.150",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.104",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.45",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix race with concurrent opens in rename(2)\n\nBesides sending the rename request to the server, the rename process\nalso involves closing any deferred close, waiting for outstanding I/O\nto complete as well as marking all existing open handles as deleted to\nprevent them from deferring closes, which increases the race window\nfor potential concurrent opens on the target file.\n\nFix this by unhashing the dentry in advance to prevent any concurrent\nopens on the target."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely by local syscalls \u2014 one thread in `rename(2)`/`renameat2(2)` reaching `cifs_rename2()` and another in `open(2)` hitting the still-hashed target dentry via `lookup_fast()`. No network peer initiates the attack; a remote SMB server can only widen the window by delaying responses.\nAC:L - The attacker owns both sides of the race and the window is enormous \u2014 it spans an unbounded `netfs_wait_for_outstanding_io()` wait, deferred-close teardown, and a full SMB round trip plus a 3-iteration retry loop. The attacker can widen it arbitrarily by keeping I/O outstanding on the target, making it trivially winnable with a simple rename/open loop.\nPR:L - Any unprivileged local user with ordinary access to a directory on an already-mounted CIFS/SMB share can call rename(2) and open(2); no capabilities are required. Mounted SMB shares are routine on enterprise desktops, autofs home directories, and containers with CIFS volumes.\nUI:N - Both racing threads are the attacker\u0027s own; no victim action is needed. The presence of an SMB mount is a standing system configuration, not a per-exploit user interaction.\nS:U - The corruption of dcache/deferred-handle state and the resulting file damage stay entirely within the kernel and the mounted filesystem\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A handle opened inside the race escapes `cifs_mark_open_handles_for_deleted_file()` and remains on `tcon-\u003eopenFileList`, where `cifs_get_readable_path()` matches cached handles by path string \u2014 so a later `open(2)`/`read(2)` of that path can be served from the stale handle to the pre-rename file, disclosing unbounded contents of a file (potentially another user\u0027s) that should no longer be reachable at that name.\nI:H - The racing open makes the target appear busy, driving `cifs_rename2()` into the `unlink_target:` path that deletes the target file and retries \u2014 on retry failure the file\u0027s data is destroyed while rename(2) reports an error (the documented data-loss mode fixed by the later `c5ea3065586d`). The same stale path-matched handle also lets writes land on the wrong server-side object.\nA:H - By keeping opens and I/O active on the still-hashed target, the attacker prevents `netfs_wait_for_outstanding_io()`\u0027s `io_count` from ever reaching zero, pinning the renaming task in unkillable uninterruptible sleep while it holds the parent directory\u0027s `i_rwsem` exclusively \u2014 starving all other operations in that directory and triggering hung-task warnings (panic with `hung_task_panic=1`)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:27.067Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c9e7de284da0be5b44dbe79d71573f9f7f9b144c"
        },
        {
          "url": "https://git.kernel.org/stable/c/24b9ed739c8c5b464d983e12cf308982f3ae93c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9991af5e09924f6f3b3e6996a5e09f9504b4358"
        },
        {
          "url": "https://git.kernel.org/stable/c/289f945acb20b9b54fe4d13895e44aa58965ddb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d84291fc7453df7881a970716f8256273aca5747"
        }
      ],
      "title": "smb: client: fix race with concurrent opens in rename(2)",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39825",
    "datePublished": "2025-09-16T13:00:23.897Z",
    "dateReserved": "2025-04-16T07:20:57.140Z",
    "dateUpdated": "2026-08-05T12:05:27.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39825",
      "date": "2026-08-05",
      "epss": "0.00108",
      "percentile": "0.01365"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:57:42.000Z",
      "cve": "CVE-2025-39825",
      "id": "msrc_CVE-2025-39825",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix race with concurrent opens in rename(2)",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39825.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39825\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-16T13:16:01.780\",\"lastModified\":\"2026-07-30T06:23:48.670\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix race with concurrent opens in rename(2)\\n\\nBesides sending the rename request to the server, the rename process\\nalso involves closing any deferred close, waiting for outstanding I/O\\nto complete as well as marking all existing open handles as deleted to\\nprevent them from deferring closes, which increases the race window\\nfor potential concurrent opens on the target file.\\n\\nFix this by unhashing the dentry in advance to prevent any concurrent\\nopens on the target.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"78c09634f7dc061a3bd09704cdbebb3762a45cdf\",\"lessThan\":\"c9e7de284da0be5b44dbe79d71573f9f7f9b144c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"78c09634f7dc061a3bd09704cdbebb3762a45cdf\",\"lessThan\":\"24b9ed739c8c5b464d983e12cf308982f3ae93c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"78c09634f7dc061a3bd09704cdbebb3762a45cdf\",\"lessThan\":\"c9991af5e09924f6f3b3e6996a5e09f9504b4358\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"78c09634f7dc061a3bd09704cdbebb3762a45cdf\",\"lessThan\":\"289f945acb20b9b54fe4d13895e44aa58965ddb2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"78c09634f7dc061a3bd09704cdbebb3762a45cdf\",\"lessThan\":\"d84291fc7453df7881a970716f8256273aca5747\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.150\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.104\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.45\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.5\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC CN 4100\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V5.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:41:27.081852Z\",\"id\":\"CVE-2025-39825\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"6.1.150\",\"matchCriteriaId\":\"2EE6DDDA-64F6-4739-86EF-21776577C9FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.104\",\"matchCriteriaId\":\"FD12E3C3-F737-4936-9A57-80832E36D22F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.45\",\"matchCriteriaId\":\"DC443D7D-A411-41FB-BB45-010F36EF7C94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.5\",\"matchCriteriaId\":\"EB781080-7001-4FA1-B388-517FFEFBC73E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24b9ed739c8c5b464d983e12cf308982f3ae93c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/289f945acb20b9b54fe4d13895e44aa58965ddb2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9991af5e09924f6f3b3e6996a5e09f9504b4358\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9e7de284da0be5b44dbe79d71573f9f7f9b144c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d84291fc7453df7881a970716f8256273aca5747\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-032379.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:58:50+00:00",
      "cve": "CVE-2025-39825",
      "id": "CVE-2025-39825",
      "initial_release_date": "2025-09-16T00:00:00+00:00",
      "product_status:fixed": "1364",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "70",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix race with concurrent opens in rename(2)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39825.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T17:43:46.244Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC CN 4100\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V5.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-032379.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T12:07:20.499Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39825\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:41:27.081852Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:38:22.424Z\"}}], \"cna\": {\"title\": \"smb: client: fix race with concurrent opens in rename(2)\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"78c09634f7dc061a3bd09704cdbebb3762a45cdf\", \"lessThan\": \"c9e7de284da0be5b44dbe79d71573f9f7f9b144c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"78c09634f7dc061a3bd09704cdbebb3762a45cdf\", \"lessThan\": \"24b9ed739c8c5b464d983e12cf308982f3ae93c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"78c09634f7dc061a3bd09704cdbebb3762a45cdf\", \"lessThan\": \"c9991af5e09924f6f3b3e6996a5e09f9504b4358\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"78c09634f7dc061a3bd09704cdbebb3762a45cdf\", \"lessThan\": \"289f945acb20b9b54fe4d13895e44aa58965ddb2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"78c09634f7dc061a3bd09704cdbebb3762a45cdf\", \"lessThan\": \"d84291fc7453df7881a970716f8256273aca5747\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/smb/client/inode.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.150\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.104\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.45\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/client/inode.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c9e7de284da0be5b44dbe79d71573f9f7f9b144c\"}, {\"url\": \"https://git.kernel.org/stable/c/24b9ed739c8c5b464d983e12cf308982f3ae93c2\"}, {\"url\": \"https://git.kernel.org/stable/c/c9991af5e09924f6f3b3e6996a5e09f9504b4358\"}, {\"url\": \"https://git.kernel.org/stable/c/289f945acb20b9b54fe4d13895e44aa58965ddb2\"}, {\"url\": \"https://git.kernel.org/stable/c/d84291fc7453df7881a970716f8256273aca5747\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix race with concurrent opens in rename(2)\\n\\nBesides sending the rename request to the server, the rename process\\nalso involves closing any deferred close, waiting for outstanding I/O\\nto complete as well as marking all existing open handles as deleted to\\nprevent them from deferring closes, which increases the race window\\nfor potential concurrent opens on the target file.\\n\\nFix this by unhashing the dentry in advance to prevent any concurrent\\nopens on the target.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.150\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.104\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.45\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.5\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"5.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-07-30T05:57:51.589Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39825\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T05:57:51.589Z\", \"dateReserved\": \"2025-04-16T07:20:57.140Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-16T13:00:23.897Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.