In the Linux kernel, the following vulnerability has been resolved:
smb: client: Avoid race in opencacheddir with lease breaks
A pre-existing valid cfid returned from findorcreatecacheddir might race with a lease break, meaning opencacheddir doesn't consider it valid, and thinks it's newly-constructed. This leaks a dentry reference if the allocation occurs before the queued lease break work runs.
Avoid the race by extending holding the cfidlistlock across findorcreatecacheddir and when the result is checked.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37954.json"
}