In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free in cifsoplockbreak
A race condition can occur in cifsoplockbreak() leading to a use-after-free of the cinode structure when unmounting:
cifsoplockbreak() cifsFileInfoput(cfile) cifsFileInfoputfinal() cifssbdeactive() [last ref, start releasing sb] killsb() killanonsuper() genericshutdownsuper() evictinodes() disposelist() evict() destroyinode() callrcu(&inode->ircu, icallback) spinlock(&cinode->openfilelock) <- OK [later] icallback() cifsfreeinode() kmemcachefree(cinode) spinunlock(&cinode->openfilelock) <- UAF cifsdoneoplock_break(cinode) <- UAF
The issue occurs when umount has already released its reference to the superblock. When cifsFileInfoput() calls cifssbdeactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifsoplockbreak() continues to access the cinode after this point, resulting in use-after-free.
Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.
[
{
"digest": {
"length": 1931.0,
"function_hash": "338822425992882720993935257659943399119"
},
"target": {
"file": "fs/cifs/file.c",
"function": "cifs_oplock_break"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4256a483fe58af66a46cbf3dc48ff26e580d3308",
"id": "CVE-2025-38527-222565b7",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"93422690346105264466792377146934326683",
"42055629294895708927433031456330301490",
"230798178386352633346109453412169474379",
"169404852972179638483478508582189481923",
"289783552315080300950911705729331305675",
"146380509797741559904505702122794296668",
"14144837439336295312848784491830234188",
"98269474633137199177964433612777406740",
"29329139516809199391021627625740702863",
"167168366967244552940181655596555520466",
"194767310350399563368889217689906322438"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/file.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b",
"id": "CVE-2025-38527-561c48f9",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"93422690346105264466792377146934326683",
"42055629294895708927433031456330301490",
"230798178386352633346109453412169474379",
"169404852972179638483478508582189481923",
"289783552315080300950911705729331305675",
"146380509797741559904505702122794296668",
"14144837439336295312848784491830234188",
"98269474633137199177964433612777406740",
"29329139516809199391021627625740702863",
"167168366967244552940181655596555520466",
"194767310350399563368889217689906322438"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/file.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2baaf5bbab2ac474c4f92c10fcb3310f824db995",
"id": "CVE-2025-38527-6fcbfb19",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"93422690346105264466792377146934326683",
"42055629294895708927433031456330301490",
"230798178386352633346109453412169474379",
"169404852972179638483478508582189481923",
"289783552315080300950911705729331305675",
"146380509797741559904505702122794296668",
"14144837439336295312848784491830234188",
"98269474633137199177964433612777406740",
"29329139516809199391021627625740702863",
"144600910537715665243390027413064753585",
"24051419743964784552936794913201149065"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/file.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@705c79101ccf9edea5a00d761491a03ced314210",
"id": "CVE-2025-38527-7ca41a91",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 1924.0,
"function_hash": "30561789634219461078726261303725793515"
},
"target": {
"file": "fs/smb/client/file.c",
"function": "cifs_oplock_break"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da11bd4b697b393a207f19a2ed7d382a811a3ddc",
"id": "CVE-2025-38527-848d22e4",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1931.0,
"function_hash": "338822425992882720993935257659943399119"
},
"target": {
"file": "fs/smb/client/file.c",
"function": "cifs_oplock_break"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2baaf5bbab2ac474c4f92c10fcb3310f824db995",
"id": "CVE-2025-38527-ae2356e9",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"93422690346105264466792377146934326683",
"42055629294895708927433031456330301490",
"230798178386352633346109453412169474379",
"169404852972179638483478508582189481923",
"289783552315080300950911705729331305675",
"146380509797741559904505702122794296668",
"14144837439336295312848784491830234188",
"98269474633137199177964433612777406740",
"29329139516809199391021627625740702863",
"144600910537715665243390027413064753585",
"24051419743964784552936794913201149065"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/file.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da11bd4b697b393a207f19a2ed7d382a811a3ddc",
"id": "CVE-2025-38527-c58c14ac",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 1924.0,
"function_hash": "30561789634219461078726261303725793515"
},
"target": {
"file": "fs/smb/client/file.c",
"function": "cifs_oplock_break"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@705c79101ccf9edea5a00d761491a03ced314210",
"id": "CVE-2025-38527-e8dc5d3c",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1931.0,
"function_hash": "338822425992882720993935257659943399119"
},
"target": {
"file": "fs/smb/client/file.c",
"function": "cifs_oplock_break"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b",
"id": "CVE-2025-38527-e9150c63",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1931.0,
"function_hash": "338822425992882720993935257659943399119"
},
"target": {
"file": "fs/smb/client/file.c",
"function": "cifs_oplock_break"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09bce2138a30ef10d8821c8c3f73a4ab7a5726bc",
"id": "CVE-2025-38527-eb378643",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"93422690346105264466792377146934326683",
"42055629294895708927433031456330301490",
"230798178386352633346109453412169474379",
"169404852972179638483478508582189481923",
"289783552315080300950911705729331305675",
"146380509797741559904505702122794296668",
"14144837439336295312848784491830234188",
"98269474633137199177964433612777406740",
"29329139516809199391021627625740702863",
"167168366967244552940181655596555520466",
"194767310350399563368889217689906322438"
],
"threshold": 0.9
},
"target": {
"file": "fs/cifs/file.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4256a483fe58af66a46cbf3dc48ff26e580d3308",
"id": "CVE-2025-38527-ecce8a33",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"93422690346105264466792377146934326683",
"42055629294895708927433031456330301490",
"230798178386352633346109453412169474379",
"169404852972179638483478508582189481923",
"289783552315080300950911705729331305675",
"146380509797741559904505702122794296668",
"14144837439336295312848784491830234188",
"98269474633137199177964433612777406740",
"29329139516809199391021627625740702863",
"144600910537715665243390027413064753585",
"24051419743964784552936794913201149065"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/file.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09bce2138a30ef10d8821c8c3f73a4ab7a5726bc",
"id": "CVE-2025-38527-ed58f99b",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
}
]