In the Linux kernel, the following vulnerability has been resolved:
smb/server: avoid deadlock when linking with ReplaceIfExists
If smb2createlink() is called with ReplaceIfExists set and the name does exist then a deadlock will happen.
ksmbdvfskernpathlocked() will return with success and the parent directory will be locked. ksmbdvfsremovefile() will then remove the file. ksmbdvfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock.
This patch moves the ksmbdvfskernpathunlock() call to before ksmbdvfslink() and then simplifies the code, removing the file_present flag variable.
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"51819943507919760153825620673325510578",
"81008025904484502943614719989274804302",
"52519360757608999965822783879007136970",
"175127639379781321519602279133805701848",
"136697783008947056245413493067518006330",
"275907241417233124468301071307887573481",
"154553602666151068094356277409706969532",
"298355481660795108909669480377871422466",
"104724852572654313312822176673450362043",
"151027731007380737918595972306265152753",
"113251923271887941430722771396490864485",
"115147509515332949097341990418946253638",
"5685384156562927543555660064859193229",
"269008522121125225892984661368180584006",
"128078957035104182587966748602210724194",
"57764425850945595123850028189879769197",
"278430243161225114881579337260110904263",
"167444160813027234166546843196241782392",
"1735465744350592596945853405936122537",
"105830630859880079786007133616222197037",
"6429653302534447462906384256018702271",
"264858467899828786213772702167429746748",
"73723586904316379749182174106901305345",
"308576469163199450275713633900415831994",
"201839442579792478760657308067334853577",
"134096557800076596198534257139095939889",
"87225392583940510854401846158324668257",
"310453029472309385921982389828007806836"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e858a7a51c7b8b009d8f246de7ceb7743b44a71",
"id": "CVE-2025-38711-0682e76b",
"signature_version": "v1",
"target": {
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"51819943507919760153825620673325510578",
"81008025904484502943614719989274804302",
"52519360757608999965822783879007136970",
"175127639379781321519602279133805701848",
"136697783008947056245413493067518006330",
"275907241417233124468301071307887573481",
"154553602666151068094356277409706969532",
"298355481660795108909669480377871422466",
"104724852572654313312822176673450362043",
"151027731007380737918595972306265152753",
"113251923271887941430722771396490864485",
"115147509515332949097341990418946253638",
"5685384156562927543555660064859193229",
"269008522121125225892984661368180584006",
"128078957035104182587966748602210724194",
"57764425850945595123850028189879769197",
"278430243161225114881579337260110904263",
"167444160813027234166546843196241782392",
"1735465744350592596945853405936122537",
"105830630859880079786007133616222197037",
"6429653302534447462906384256018702271",
"264858467899828786213772702167429746748",
"73723586904316379749182174106901305345",
"308576469163199450275713633900415831994",
"201839442579792478760657308067334853577",
"134096557800076596198534257139095939889",
"87225392583940510854401846158324668257",
"310453029472309385921982389828007806836"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694",
"id": "CVE-2025-38711-0d6008bc",
"signature_version": "v1",
"target": {
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "160169219991670922647657934377538074843",
"length": 1454.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a726fef6d7d4cfc365d3434e3916dbfe78991a33",
"id": "CVE-2025-38711-2811ad83",
"signature_version": "v1",
"target": {
"function": "smb2_create_link",
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "160169219991670922647657934377538074843",
"length": 1454.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7dddd62578c2eb6cb28b8835556a121b5157323",
"id": "CVE-2025-38711-3ccb7e1f",
"signature_version": "v1",
"target": {
"function": "smb2_create_link",
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "220521547933122891988591845293248299569",
"length": 1447.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d5012ffe14120f978ee34aef4df3d6cb026b7c4",
"id": "CVE-2025-38711-7541f21b",
"signature_version": "v1",
"target": {
"function": "smb2_create_link",
"file": "fs/ksmbd/smb2pdu.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"51819943507919760153825620673325510578",
"81008025904484502943614719989274804302",
"52519360757608999965822783879007136970",
"175127639379781321519602279133805701848",
"136697783008947056245413493067518006330",
"275907241417233124468301071307887573481",
"154553602666151068094356277409706969532",
"298355481660795108909669480377871422466",
"104724852572654313312822176673450362043",
"151027731007380737918595972306265152753",
"113251923271887941430722771396490864485",
"115147509515332949097341990418946253638",
"5685384156562927543555660064859193229",
"269008522121125225892984661368180584006",
"128078957035104182587966748602210724194",
"57764425850945595123850028189879769197",
"278430243161225114881579337260110904263",
"167444160813027234166546843196241782392",
"1735465744350592596945853405936122537",
"105830630859880079786007133616222197037",
"6429653302534447462906384256018702271",
"264858467899828786213772702167429746748",
"73723586904316379749182174106901305345",
"308576469163199450275713633900415831994",
"201839442579792478760657308067334853577",
"134096557800076596198534257139095939889",
"87225392583940510854401846158324668257",
"310453029472309385921982389828007806836"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7dddd62578c2eb6cb28b8835556a121b5157323",
"id": "CVE-2025-38711-7f377b0f",
"signature_version": "v1",
"target": {
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"51819943507919760153825620673325510578",
"81008025904484502943614719989274804302",
"52519360757608999965822783879007136970",
"175127639379781321519602279133805701848",
"136697783008947056245413493067518006330",
"275907241417233124468301071307887573481",
"154553602666151068094356277409706969532",
"298355481660795108909669480377871422466",
"104724852572654313312822176673450362043",
"151027731007380737918595972306265152753",
"113251923271887941430722771396490864485",
"115147509515332949097341990418946253638",
"5685384156562927543555660064859193229",
"269008522121125225892984661368180584006",
"128078957035104182587966748602210724194",
"57764425850945595123850028189879769197",
"278430243161225114881579337260110904263",
"167444160813027234166546843196241782392",
"1735465744350592596945853405936122537",
"105830630859880079786007133616222197037",
"6429653302534447462906384256018702271",
"264858467899828786213772702167429746748",
"73723586904316379749182174106901305345",
"308576469163199450275713633900415831994",
"201839442579792478760657308067334853577",
"134096557800076596198534257139095939889",
"87225392583940510854401846158324668257",
"310453029472309385921982389828007806836"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d5012ffe14120f978ee34aef4df3d6cb026b7c4",
"id": "CVE-2025-38711-89e50f9d",
"signature_version": "v1",
"target": {
"file": "fs/ksmbd/smb2pdu.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "160169219991670922647657934377538074843",
"length": 1454.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694",
"id": "CVE-2025-38711-98f13c63",
"signature_version": "v1",
"target": {
"function": "smb2_create_link",
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "220521547933122891988591845293248299569",
"length": 1447.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e858a7a51c7b8b009d8f246de7ceb7743b44a71",
"id": "CVE-2025-38711-b592752f",
"signature_version": "v1",
"target": {
"function": "smb2_create_link",
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "160169219991670922647657934377538074843",
"length": 1454.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@814cfdb6358d9b84fcbec9918c8f938cc096a43a",
"id": "CVE-2025-38711-d2a807f1",
"signature_version": "v1",
"target": {
"function": "smb2_create_link",
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"51819943507919760153825620673325510578",
"81008025904484502943614719989274804302",
"52519360757608999965822783879007136970",
"175127639379781321519602279133805701848",
"136697783008947056245413493067518006330",
"275907241417233124468301071307887573481",
"154553602666151068094356277409706969532",
"298355481660795108909669480377871422466",
"104724852572654313312822176673450362043",
"151027731007380737918595972306265152753",
"113251923271887941430722771396490864485",
"115147509515332949097341990418946253638",
"5685384156562927543555660064859193229",
"269008522121125225892984661368180584006",
"128078957035104182587966748602210724194",
"57764425850945595123850028189879769197",
"278430243161225114881579337260110904263",
"167444160813027234166546843196241782392",
"1735465744350592596945853405936122537",
"105830630859880079786007133616222197037",
"6429653302534447462906384256018702271",
"264858467899828786213772702167429746748",
"73723586904316379749182174106901305345",
"308576469163199450275713633900415831994",
"201839442579792478760657308067334853577",
"134096557800076596198534257139095939889",
"87225392583940510854401846158324668257",
"310453029472309385921982389828007806836"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a726fef6d7d4cfc365d3434e3916dbfe78991a33",
"id": "CVE-2025-38711-dda50595",
"signature_version": "v1",
"target": {
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "220521547933122891988591845293248299569",
"length": 1447.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac98d54630d5b52e3f684d872f0d82c06c418ea9",
"id": "CVE-2025-38711-e5302023",
"signature_version": "v1",
"target": {
"function": "smb2_create_link",
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"51819943507919760153825620673325510578",
"81008025904484502943614719989274804302",
"52519360757608999965822783879007136970",
"175127639379781321519602279133805701848",
"136697783008947056245413493067518006330",
"275907241417233124468301071307887573481",
"154553602666151068094356277409706969532",
"298355481660795108909669480377871422466",
"104724852572654313312822176673450362043",
"151027731007380737918595972306265152753",
"113251923271887941430722771396490864485",
"115147509515332949097341990418946253638",
"5685384156562927543555660064859193229",
"269008522121125225892984661368180584006",
"128078957035104182587966748602210724194",
"57764425850945595123850028189879769197",
"278430243161225114881579337260110904263",
"167444160813027234166546843196241782392",
"1735465744350592596945853405936122537",
"105830630859880079786007133616222197037",
"6429653302534447462906384256018702271",
"264858467899828786213772702167429746748",
"73723586904316379749182174106901305345",
"308576469163199450275713633900415831994",
"201839442579792478760657308067334853577",
"134096557800076596198534257139095939889",
"87225392583940510854401846158324668257",
"310453029472309385921982389828007806836"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@814cfdb6358d9b84fcbec9918c8f938cc096a43a",
"id": "CVE-2025-38711-fb342d76",
"signature_version": "v1",
"target": {
"file": "fs/smb/server/smb2pdu.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"51819943507919760153825620673325510578",
"81008025904484502943614719989274804302",
"52519360757608999965822783879007136970",
"175127639379781321519602279133805701848",
"136697783008947056245413493067518006330",
"275907241417233124468301071307887573481",
"154553602666151068094356277409706969532",
"298355481660795108909669480377871422466",
"104724852572654313312822176673450362043",
"151027731007380737918595972306265152753",
"113251923271887941430722771396490864485",
"115147509515332949097341990418946253638",
"5685384156562927543555660064859193229",
"269008522121125225892984661368180584006",
"128078957035104182587966748602210724194",
"57764425850945595123850028189879769197",
"278430243161225114881579337260110904263",
"167444160813027234166546843196241782392",
"1735465744350592596945853405936122537",
"105830630859880079786007133616222197037",
"6429653302534447462906384256018702271",
"264858467899828786213772702167429746748",
"73723586904316379749182174106901305345",
"308576469163199450275713633900415831994",
"201839442579792478760657308067334853577",
"134096557800076596198534257139095939889",
"87225392583940510854401846158324668257",
"310453029472309385921982389828007806836"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac98d54630d5b52e3f684d872f0d82c06c418ea9",
"id": "CVE-2025-38711-fc15b45b",
"signature_version": "v1",
"target": {
"file": "fs/smb/server/smb2pdu.c"
}
}
]