Vulnerability-Lookup

FKIE_CVE-2025-38527

Vulnerability from fkie_nvd - Published: 2025-08-16 12:15 - Updated: 2026-10-15 22:18

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free. Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/09bce2138a30ef10d8821c8c3f73a4ab7a5726bc	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2baaf5bbab2ac474c4f92c10fcb3310f824db995	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4256a483fe58af66a46cbf3dc48ff26e580d3308	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/705c79101ccf9edea5a00d761491a03ced314210	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/da11bd4b697b393a207f19a2ed7d382a811a3ddc	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	Mailing List, Third Party Advisory

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	5.1
linux	linux_kernel	5.1
linux	linux_kernel	5.1
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	6.16
debian	debian_linux	11.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4256a483fe58af66a46cbf3dc48ff26e580d3308",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "2baaf5bbab2ac474c4f92c10fcb3310f824db995",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "09bce2138a30ef10d8821c8c3f73a4ab7a5726bc",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "da11bd4b697b393a207f19a2ed7d382a811a3ddc",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "705c79101ccf9edea5a00d761491a03ced314210",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2429fcf06d3cb962693868ab0a927c9038f12a2d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "53fc31a4853e30d6e8f142b824f724da27ff3e40",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8092ecc306d81186a64cda42411121f4d35aaff4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ebac4d0adf68f8962bd82fcf483936edd6ec095b",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.72",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.171",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.114",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.37",
              "versionType": "semver"
            },
            {
              "lessThan": "5.1",
              "status": "affected",
              "version": "5.0.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1ED01FFA-151C-4240-A234-6FEB9BAD08A8",
              "versionEndExcluding": "3.17",
              "versionStartIncluding": "3.16.72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1638DAE4-6580-4DE9-A2E4-E3F5A4C44F56",
              "versionEndExcluding": "4.10",
              "versionStartIncluding": "4.9.171",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34B2FC78-6012-4CCB-9F23-9F3EBC1E9463",
              "versionEndExcluding": "4.15",
              "versionStartIncluding": "4.14.114",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "84DD5BD5-6192-400A-861A-177194C762B3",
              "versionEndExcluding": "4.20",
              "versionStartIncluding": "4.19.37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB9573B4-2670-4E51-BD98-77B010DD43B7",
              "versionEndExcluding": "5.1",
              "versionStartIncluding": "5.0.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CBC473A-889D-48AC-8327-7A8551247196",
              "versionEndExcluding": "5.15.190",
              "versionStartIncluding": "5.1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4FD62FC-0DAE-4ACE-8C9C-66156518C3E1",
              "versionEndExcluding": "6.1.147",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "094B81E0-B756-4727-85CA-F3F8D1C9D116",
              "versionEndExcluding": "6.6.100",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0099D5A4-B157-4D36-8858-982C7D579030",
              "versionEndExcluding": "6.12.40",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746",
              "versionEndExcluding": "6.15.8",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "D89FA266-EDB9-412A-B18E-1B5A0FCC3C0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.1:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "9CC18FCC-3F69-4A7E-9F29-4C4504E83B4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.1:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "12A5D914-5CEB-4D3F-A903-6F1FAD82A125",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in cifs_oplock_break\n\nA race condition can occur in cifs_oplock_break() leading to a\nuse-after-free of the cinode structure when unmounting:\n\n  cifs_oplock_break()\n    _cifsFileInfo_put(cfile)\n      cifsFileInfo_put_final()\n        cifs_sb_deactive()\n          [last ref, start releasing sb]\n            kill_sb()\n              kill_anon_super()\n                generic_shutdown_super()\n                  evict_inodes()\n                    dispose_list()\n                      evict()\n                        destroy_inode()\n                          call_rcu(\u0026inode-\u003ei_rcu, i_callback)\n    spin_lock(\u0026cinode-\u003eopen_file_lock)  \u003c- OK\n                            [later] i_callback()\n                              cifs_free_inode()\n                                kmem_cache_free(cinode)\n    spin_unlock(\u0026cinode-\u003eopen_file_lock)  \u003c- UAF\n    cifs_done_oplock_break(cinode)       \u003c- UAF\n\nThe issue occurs when umount has already released its reference to the\nsuperblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this\nreleases the last reference, triggering the immediate cleanup of all\ninodes under RCU. However, cifs_oplock_break() continues to access the\ncinode after this point, resulting in use-after-free.\n\nFix this by holding an extra reference to the superblock during the\nentire oplock break operation. This ensures that the superblock and\nits inodes remain valid until the oplock break completes."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: correcci\u00f3n duse after free en cifs_oplock_break. Puede producirse una condici\u00f3n de ejecuci\u00f3n en cifs_oplock_break() que provoca un use after free de la estructura cinode al desmontar: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [\u00faltima referencia, iniciar la liberaci\u00f3n de sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(\u0026amp;inode-\u0026gt;i_rcu, i_callback) spin_lock(\u0026amp;cinode-\u0026gt;open_file_lock) \u0026lt;- OK [m\u00e1s tarde] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(\u0026amp;cinode-\u0026gt;open_file_lock) \u0026lt;- UAF cifs_done_oplock_break(cinode) \u0026lt;- UAF El problema ocurre cuando umount ya ha liberado su referencia al superbloque. Cuando _cifsFileInfo_put() llama a cifs_sb_deactive(), se libera la \u00faltima referencia, lo que desencadena la limpieza inmediata de todos los inodos bajo RCU. Sin embargo, cifs_oplock_break() contin\u00faa accediendo al cinode despu\u00e9s de este punto, lo que resulta en un use after free. Para solucionar esto, mantenga una referencia adicional al superbloque durante toda la operaci\u00f3n de ruptura del oplock. Esto garantiza que el superbloque y sus inodos sigan siendo v\u00e1lidos hasta que se complete la ruptura del oplock."
    }
  ],
  "id": "CVE-2025-38527",
  "lastModified": "2026-10-15T22:18:44.583",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-38527",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-15T21:51:26.435108Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-08-16T12:15:28.183",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/09bce2138a30ef10d8821c8c3f73a4ab7a5726bc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2baaf5bbab2ac474c4f92c10fcb3310f824db995"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4256a483fe58af66a46cbf3dc48ff26e580d3308"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/705c79101ccf9edea5a00d761491a03ced314210"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/da11bd4b697b393a207f19a2ed7d382a811a3ddc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2025-38527 (GCVE-0-2025-38527)

Vulnerability from cvelistv5 – Published: 2025-08-16 11:12 – Updated: 2026-10-15 21:52

Title

smb: client: fix use-after-free in cifs_oplock_break

Summary

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 21:51 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/4256a483fe58af66a…
https://git.kernel.org/stable/c/0a4eec84d4d2c4085…
https://git.kernel.org/stable/c/2baaf5bbab2ac474c…
https://git.kernel.org/stable/c/09bce2138a30ef10d…
https://git.kernel.org/stable/c/da11bd4b697b393a2…
https://git.kernel.org/stable/c/705c79101ccf9edea…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b98749cac4a695f084a5ff076f4510b23e353ecd , < 4256a483fe58af66a46cbf3dc48ff26e580d3308 (git) Affected: b98749cac4a695f084a5ff076f4510b23e353ecd , < 0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b (git) Affected: b98749cac4a695f084a5ff076f4510b23e353ecd , < 2baaf5bbab2ac474c4f92c10fcb3310f824db995 (git) Affected: b98749cac4a695f084a5ff076f4510b23e353ecd , < 09bce2138a30ef10d8821c8c3f73a4ab7a5726bc (git) Affected: b98749cac4a695f084a5ff076f4510b23e353ecd , < da11bd4b697b393a207f19a2ed7d382a811a3ddc (git) Affected: b98749cac4a695f084a5ff076f4510b23e353ecd , < 705c79101ccf9edea5a00d761491a03ced314210 (git) Affected: 2429fcf06d3cb962693868ab0a927c9038f12a2d (git) Affected: 1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12 (git) Affected: 53fc31a4853e30d6e8f142b824f724da27ff3e40 (git) Affected: 8092ecc306d81186a64cda42411121f4d35aaff4 (git) Affected: ebac4d0adf68f8962bd82fcf483936edd6ec095b (git) Affected: 3.16.72 , < 3.17 (semver) Affected: 4.9.171 , < 4.10 (semver) Affected: 4.14.114 , < 4.15 (semver) Affected: 4.19.37 , < 4.20 (semver) Affected: 5.0.10 , < 5.1 (semver)
Linux	Linux	Affected: 5.1 Unaffected: 0 , < 5.1 (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.147 , ≤ 6.1.* (semver) Unaffected: 6.6.100 , ≤ 6.6.* (semver) Unaffected: 6.12.40 , ≤ 6.12.* (semver) Unaffected: 6.15.8 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:23.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38527",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:51:26.435108Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T21:52:18.718Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4256a483fe58af66a46cbf3dc48ff26e580d3308",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "2baaf5bbab2ac474c4f92c10fcb3310f824db995",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "09bce2138a30ef10d8821c8c3f73a4ab7a5726bc",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "da11bd4b697b393a207f19a2ed7d382a811a3ddc",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "lessThan": "705c79101ccf9edea5a00d761491a03ced314210",
              "status": "affected",
              "version": "b98749cac4a695f084a5ff076f4510b23e353ecd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2429fcf06d3cb962693868ab0a927c9038f12a2d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "53fc31a4853e30d6e8f142b824f724da27ff3e40",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8092ecc306d81186a64cda42411121f4d35aaff4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ebac4d0adf68f8962bd82fcf483936edd6ec095b",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.72",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.171",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.114",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.37",
              "versionType": "semver"
            },
            {
              "lessThan": "5.1",
              "status": "affected",
              "version": "5.0.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.171",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.114",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.0.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in cifs_oplock_break\n\nA race condition can occur in cifs_oplock_break() leading to a\nuse-after-free of the cinode structure when unmounting:\n\n  cifs_oplock_break()\n    _cifsFileInfo_put(cfile)\n      cifsFileInfo_put_final()\n        cifs_sb_deactive()\n          [last ref, start releasing sb]\n            kill_sb()\n              kill_anon_super()\n                generic_shutdown_super()\n                  evict_inodes()\n                    dispose_list()\n                      evict()\n                        destroy_inode()\n                          call_rcu(\u0026inode-\u003ei_rcu, i_callback)\n    spin_lock(\u0026cinode-\u003eopen_file_lock)  \u003c- OK\n                            [later] i_callback()\n                              cifs_free_inode()\n                                kmem_cache_free(cinode)\n    spin_unlock(\u0026cinode-\u003eopen_file_lock)  \u003c- UAF\n    cifs_done_oplock_break(cinode)       \u003c- UAF\n\nThe issue occurs when umount has already released its reference to the\nsuperblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this\nreleases the last reference, triggering the immediate cleanup of all\ninodes under RCU. However, cifs_oplock_break() continues to access the\ncinode after this point, resulting in use-after-free.\n\nFix this by holding an extra reference to the superblock during the\nentire oplock break operation. This ensures that the superblock and\nits inodes remain valid until the oplock break completes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The freeing side is driven entirely by a remote SMB peer \u2014 `smb2_is_valid_oplock_break()` (fs/smb/client/smb2misc.c:712) parses unsolicited SMB2 OPLOCK_BREAK/LEASE_BREAK PDUs off the socket and queues `cifs_oplock_break()`, and the server also controls the stalls (`filemap_fdatawrite`/`fdatawait`, tree disconnect) that widen the window. A malicious, compromised, or on-path SMB server (signing is frequently absent) reaches this over the network or WAN.\nAC:L - This is not a tight race: the attacker parks the worker indefinitely by refusing to complete writeback, so whenever the unmount lands the worker deterministically holds the last superblock reference, and it then releases the stall at a time of its choosing. The intervening `kill_sb` network round trips guarantee the RCU grace period elapses before `cifs_done_oplock_break(cinode)`, making the use-after-free reliable and infinitely repeatable.\nPR:N - The attacker is the remote SMB server or an on-path attacker and holds no credentials, account, or capability on the victim client; oplock/lease breaks are unsolicited server-to-client notifications handled by the demultiplex thread. Client-side mount configuration is a deployment condition, not an attacker privilege.\nUI:N - The CIFS mount is a standing deployment condition (fstab/autofs/systemd `.automount`/pam_mount), and the required unmount happens automatically on idle expiry, logout, or attacker-induced link loss \u2014 no person participates. Because the attacker can hold the oplock-break worker parked indefinitely, it need only wait for that automatic teardown rather than race any user action.\nS:U - The use-after-free corrupts kernel slab memory (`cifs_inode_cache`) within the same kernel security authority as the vulnerable CIFS client code. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - When the freed `openFileList` head is groomed to appear non-empty, `smb2_oplock_response()` reads `cinode-\u003elease_key` out of freed slab memory and transmits it to the attacker\u0027s server in the break acknowledgement \u2014 a repeatable kernel-heap infoleak \u2014 and dereferences `cinode-\u003enetfs.inode.i_sb-\u003es_fs_info` from the dead object. Controlling the reallocated object escalates this to arbitrary kernel memory disclosure.\nI:H - `spin_unlock(\u0026cinode-\u003eopen_file_lock)` and `cifs_done_oplock_break()`\u0027s `clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, \u0026cinode-\u003eflags)` are out-of-lifetime writes at fixed offsets into whatever object reclaims the freed `cifsInodeInfo`, and the attacker can refill that slab with inodes whose fields come from its own server responses. Combined with the wild `i_sb-\u003es_fs_info` dereference, this is the standard heap-grooming path to a write primitive and control-flow hijack.\nA:H - Operating on the freed `cifsInodeInfo` \u2014 spinlock manipulation, list traversal, and a bit clear on released slab memory \u2014 produces KASAN splats, slab corruption, and oops/panic, as reported in kernel.org bugzilla #220309. The remote server can retrigger the sequence at will on every mount cycle."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:40.247Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4256a483fe58af66a46cbf3dc48ff26e580d3308"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2baaf5bbab2ac474c4f92c10fcb3310f824db995"
        },
        {
          "url": "https://git.kernel.org/stable/c/09bce2138a30ef10d8821c8c3f73a4ab7a5726bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/da11bd4b697b393a207f19a2ed7d382a811a3ddc"
        },
        {
          "url": "https://git.kernel.org/stable/c/705c79101ccf9edea5a00d761491a03ced314210"
        }
      ],
      "title": "smb: client: fix use-after-free in cifs_oplock_break",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38527",
    "datePublished": "2025-08-16T11:12:20.843Z",
    "dateReserved": "2025-04-16T04:51:24.023Z",
    "dateUpdated": "2026-10-15T21:52:18.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted