CVE-2025-38527

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_fre...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= b98749cac4a695f084a5ff076f4510b23e353ecd < 4256a483fe58af66a46cbf3dc48ff26e580d3308, >= b98749cac4a695f084a5ff076f4510b23e353ecd < 0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b, >= b98749cac4a695f084a5ff076f4510b23e353ecd < 2baaf5bbab2ac474c4f92c10fcb3310f824db995, >= b98749cac4a695f084a5ff076f4510b23e353ecd < 09bce2138a30ef10d8821c8c3f73a4ab7a5726bc, >= b98749cac4a695f084a5ff076f4510b23e353ecd < da11bd4b697b393a207f19a2ed7d382a811a3ddc, >= b98749cac4a695f084a5ff076f4510b23e353ecd < 705c79101ccf9edea5a00d761491a03ced314210, >= 2429fcf06d3cb962693868ab0a927c9038f12a2d, >= 1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12, >= 53fc31a4853e30d6e8f142b824f724da27ff3e40, >= 8092ecc306d81186a64cda42411121f4d35aaff4, >= ebac4d0adf68f8962bd82fcf483936edd6ec095b, >= 3.16.72 < 3.17, >= 4.9.171 < 4.10, >= 4.14.114 < 4.15, >= 4.19.37 < 4.20, >= 5.0.10 < 5.1, >= 5.1, >= 5.1.1 < 5.15.190, >= 5.16 < 6.1.147, >= 6.2 < 6.6.100

Fixed versions

3.17, 4.10, 4.15, 4.20, 5.1, 5.15.190, 6.1.147, 6.6.100, 6.12.40, 6.15.8

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416