{"id":"CVE-2025-39932","title":"smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)\n\nIn smbd_destroy() we may destroy the memory so we better\nwait until post_send_cre…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 5e919f0420fa3f467c0cc12bd60d08ca8a45ef8b","Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 6ae90a2baf923e85eb037b636aa641250bf4220f","Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 3fabb1236f2e3ad78d531be0a4ad9f4a4ccdda87","Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < d9dcbbcf9145b68aa85c40947311a6907277e097","Linux 4.16"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-15T21:54:50.496706Z"},"published":"2025-10-04","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:22:37.422Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39932","references":[{"url":"https://git.kernel.org/stable/c/5e919f0420fa3f467c0cc12bd60d08ca8a45ef8b"},{"url":"https://git.kernel.org/stable/c/6ae90a2baf923e85eb037b636aa641250bf4220f"},{"url":"https://git.kernel.org/stable/c/3fabb1236f2e3ad78d531be0a4ad9f4a4ccdda87"},{"url":"https://git.kernel.org/stable/c/d9dcbbcf9145b68aa85c40947311a6907277e097"}],"tags":["cve.org"],"epss":0.00305,"epssPercentile":0.23378,"ingestedAt":"2026-10-15T22:48:25.530Z","slug":"CVE-2025-39932","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)\n\nIn smbd_destroy() we may destroy the memory so we better\nwait until post_send_credits_work is no longer pending\nand will never be started again.\n\nI actually just hit the case using rxe:\n\nWARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe]\n...\n[ 5305.686979] [    T138]  smbd_post_recv+0x445/0xc10 [cifs]\n[ 5305.687135] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687149] [    T138]  ? __kasan_check_write+0x14/0x30\n[ 5305.687185] [    T138]  ? __pfx_smbd_post_recv+0x10/0x10 [cifs]\n[ 5305.687329] [    T138]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 5305.687356] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687368] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687378] [    T138]  ? _raw_spin_unlock_irqrestore+0x11/0x60\n[ 5305.687389] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687399] [    T138]  ? get_receive_buffer+0x168/0x210 [cifs]\n[ 5305.687555] [    T138]  smbd_post_send_credits+0x382/0x4b0 [cifs]\n[ 5305.687701] [    T138]  ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs]\n[ 5305.687855] [    T138]  ? __pfx___schedule+0x10/0x10\n[ 5305.687865] [    T138]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 5305.687875] [    T138]  ? queue_delayed_work_on+0x8e/0xa0\n[ 5305.687889] [    T138]  process_one_work+0x629/0xf80\n[ 5305.687908] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687917] [    T138]  ? __kasan_check_write+0x14/0x30\n[ 5305.687933] [    T138]  worker_thread+0x87f/0x1570\n...\n\nIt means rxe_post_recv was called after rdma_destroy_qp().\nThis happened because put_receive_buffer() was triggered\nby ib_drain_qp() and called:\nqueue_work(info->workqueue, &info->post_send_credits_work);\n\n## Affected\n\n- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 5e919f0420fa3f467c0cc12bd60d08ca8a45ef8b`\n- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 6ae90a2baf923e85eb037b636aa641250bf4220f`\n- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < 3fabb1236f2e3ad78d531be0a4ad9f4a4ccdda87`\n- `Linux >= f198186aa9bbd60fae7a2061f4feec614d880299 < d9dcbbcf9145b68aa85c40947311a6907277e097`\n- `Linux 4.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}