{"id":"CVE-2025-38527","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in cifs_oplock_break\n\nA race condition can occur in cifs_oplock_break() leading to a\nuse-after-free of the cinode structure when unmount…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in cifs_oplock_break\n\nA race condition can occur in cifs_oplock_break() leading to a\nuse-after-free of the cinode structure when unmount…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.16.72, < 3.17","linux_kernel >= 4.9.171, < 4.10","linux_kernel >= 4.14.114, < 4.15","linux_kernel >= 4.19.37, < 4.20","linux_kernel >= 5.0.10, < 5.1","linux_kernel >= 5.1.1, < 5.15.190","linux_kernel >= 5.16, < 6.1.147","linux_kernel >= 6.2, < 6.6.100","linux_kernel >= 6.7, < 6.12.40","linux_kernel >= 6.13, < 6.15.8","linux_kernel = 5.1","linux_kernel = 6.16","debian_linux = 11.0"],"patched":["linux_kernel 6.15.8"],"published":"2025-08-16","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:44.583","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38527","references":[{"url":"https://git.kernel.org/stable/c/09bce2138a30ef10d8821c8c3f73a4ab7a5726bc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2baaf5bbab2ac474c4f92c10fcb3310f824db995","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4256a483fe58af66a46cbf3dc48ff26e580d3308","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/705c79101ccf9edea5a00d761491a03ced314210","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da11bd4b697b393a207f19a2ed7d382a811a3ddc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00431,"epssPercentile":0.37216,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-15T21:51:26.435108Z"},"ingestedAt":"2026-10-15T22:48:25.512Z","slug":"CVE-2025-38527","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in cifs_oplock_break\n\nA race condition can occur in cifs_oplock_break() leading to a\nuse-after-free of the cinode structure when unmounting:\n\n  cifs_oplock_break()\n    _cifsFileInfo_put(cfile)\n      cifsFileInfo_put_final()\n        cifs_sb_deactive()\n          [last ref, start releasing sb]\n            kill_sb()\n              kill_anon_super()\n                generic_shutdown_super()\n                  evict_inodes()\n                    dispose_list()\n                      evict()\n                        destroy_inode()\n                          call_rcu(&inode->i_rcu, i_callback)\n    spin_lock(&cinode->open_file_lock)  <- OK\n                            [later] i_callback()\n                              cifs_free_inode()\n                                kmem_cache_free(cinode)\n    spin_unlock(&cinode->open_file_lock)  <- UAF\n    cifs_done_oplock_break(cinode)       <- UAF\n\nThe issue occurs when umount has already released its reference to the\nsuperblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this\nreleases the last reference, triggering the immediate cleanup of all\ninodes under RCU. However, cifs_oplock_break() continues to access the\ncinode after this point, resulting in use-after-free.\n\nFix this by holding an extra reference to the superblock during the\nentire oplock break operation. This ensures that the superblock and\nits inodes remain valid until the oplock break completes.\n\n## Affected\n\n- `linux_kernel >= 3.16.72, < 3.17`\n- `linux_kernel >= 4.9.171, < 4.10`\n- `linux_kernel >= 4.14.114, < 4.15`\n- `linux_kernel >= 4.19.37, < 4.20`\n- `linux_kernel >= 5.0.10, < 5.1`\n- `linux_kernel >= 5.1.1, < 5.15.190`\n- `linux_kernel >= 5.16, < 6.1.147`\n- `linux_kernel >= 6.2, < 6.6.100`\n- `linux_kernel >= 6.7, < 6.12.40`\n- `linux_kernel >= 6.13, < 6.15.8`\n- `linux_kernel = 5.1`\n- `linux_kernel = 6.16`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.15.8`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}