CVE-2025-39932

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The vulnerable teardown path is the client's SMB Direct (RDMA) transport, driven entirely by the remote SMB server peer over iWARP/RoCE/IB — the peer triggers the disconnect that enters `smbd_destroy()` via `cifs_reconnect()`/`smbd_reconnect()` and controls the receive-credit traffic that requeues `post_send_credits_work`. This matches the established scoring of other client-side smbdirect flaws (e.g. CVE-2026-31609, CVE-2026-31535) as network-reachable.

AC:LAttack complexity, low

The attacker owns both sides of the race: it initiates the RDMA disconnect that starts `smbd_destroy()`, it controls how many receive buffers are outstanding (and therefore how many `put_receive_buffer()` → `queue_work()` requeues `ib_drain_qp()` flushes), and it can force reconnect cycles indefinitely until it wins. The window is not narrow — the reporter hit it during ordinary rxe testing, and the worker's status check is a TOCTOU that a preempted worker bypasses without any signal or unusual state.

PR:NPrivileges required, none

The SMB Direct transport connect/teardown and credit machinery sits below SMB session setup, so no credentials, capability, or account on the target are validated anywhere on the path to `smbd_post_send_credits()`. The remote peer needs no privileges on the client to reset the connection and drive the teardown.

UI:NUser interaction, none

Against an already-established SMB Direct mount — persistent deployment state, not participation in the compromise — the attacker completes the whole sequence by resetting the RDMA connection; the client's demultiplex thread enters `smbd_reconnect()` → `smbd_destroy()` automatically with no victim action.

S:UScope, unchanged

The freed QP, protection domain and receive buffers are all kernel-internal objects belonging to the same security authority as the faulting code. No VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

This is a use-after-free of the `ib_qp` freed by `rdma_destroy_qp()`, whose contents are read back by `ib_post_recv()`/`ib_post_send()` (`qp->device`, `qp->valid`, queue pointers) along with a stale `sc->ib.pd->local_dma_lkey`; reclaiming that slab lets an attacker read and exfiltrate kernel memory, and stale DMA mappings can expose freed receive buffers.

I:HIntegrity impact, high

`ib_post_recv()` dispatches through `qp->device->ops.post_recv` — a function pointer loaded from freed memory — giving a control-flow hijack primitive once the QP slab is sprayed, and the driver additionally writes a WQE and producer index into the freed ring, yielding a write primitive into reclaimed memory.

A:HAvailability impact, high

The observed result is a kernel WARN/oops inside the workqueue worker, and after `sc->ib.qp = NULL` the same path is an outright NULL dereference; either panics the machine under `panic_on_oops` and otherwise wedges the SMB Direct connection, and the attacker can retrigger it on every reconnect.