CVE-2025-40328

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The freeing side of the race is driven directly by a remote peer — `smb2_is_valid_lease_break()` (fs/smb/client/smb2misc.c:692) processes unsolicited SMB2 lease-break packets from the server and calls `cached_dir_lease_break()`, which clears the lease ref and queues the final `kref_put()`; server-forced reconnects similarly drive `invalidate_all_cached_dirs()`. A malicious, compromised, or MITM'd SMB server therefore triggers the vulnerable refcount transition over the network.

AC:LAttack complexity, low

The attacker controls the timing and rate of lease breaks/reconnects and can replay them indefinitely against routine directory activity on the mount, so the narrow window between `refcount_dec_and_test()` and the lock acquisition can be hit reliably by repetition. Race conditions the attacker can retry at will are Low complexity.

PR:NPrivileges required, none

A malicious or MITM SMB server needs no credentials or privileges on the victim host; lease-break notifications are unsolicited server-to-client messages processed by the demultiplex thread. In the local variant the trigger is plain rmdir/stat/readdir on an accessible mount, requiring at most an unprivileged account.

UI:RUser interaction, required

Exploitation requires the victim to have the attacker-controlled SMB share mounted and to be performing directory lookups on it so that `find_or_create_cached_dir()` runs concurrently with the release path. The server cannot force that local access itself.

S:UScope, unchanged

The use-after-free is on a kernel slab object (`struct cached_fid`) and the impact stays within the kernel's own security authority — no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

A freed `cached_fid` holding `dentry`, `tcon`, `cifs_fid` handles, a mutex and list/work heads can be reallocated and sprayed with attacker-chosen data; the racing thread then reads it and returns cached directory/file_all_info state, giving a path to disclosing kernel memory. Per guidance, use-after-free is scored High for confidentiality.

I:HIntegrity impact, high

The stale object is written through as well as read (`kref_get`, `last_access_time`, list manipulation, `dput(cfid->dentry)` on a reused pointer, and `SMB2_close()` on stale fid values), so heap grooming turns this into a write primitive over reallocated slab contents and potential control-flow hijack via the embedded `work_struct` function pointers.

A:HAvailability impact, high

Losing the race produces a `refcount_t: addition on 0` warning followed by dereference and double-free of the `cached_fid` — including `dput()` on a freed dentry and slab corruption — reliably causing an oops or kernel panic.