LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37954: smb: client: Avoid race in open_cached_dir with lease breaks

In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't consider it valid, and thinks it's newly-constructed. This leaks a dentry reference if the allocation occurs before the queued lease break work runs. Avoid the race by extending holding the cfid_list_lock across find_or_create_cached_dir and when the result is checked.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race condition in the Linux SMB client can leak filesystem references when directory caching overlaps an SMB lease break. Repeated triggering could consume resources and reduce system availability. The supplied CVSS score is 7.5, with no indicated confidentiality or integrity impact.

Executive priority

Treat as a high-priority availability issue for Linux systems actively using SMB shares. Patch exposed and business-critical hosts promptly, while avoiding emergency escalation unsupported by exploitation evidence. Systems without kernel SMB client use are less likely to be affected.

Technical view

A cached-file identifier returned by find_or_create_cached_dir can become invalid during a concurrent lease break. open_cached_dir may then mistake it for a newly constructed object and leak a dentry reference. The kernel fix keeps cfid_list_lock held while finding and validating the cached directory.

Likely exposure

Potential exposure is limited to Linux systems running affected kernels and using the kernel SMB client. The bundle flags 6.6, 6.6.91, 6.12.29, 6.14.7, and 6.15, but lacks sufficient range semantics to determine every affected build reliably.

Exploitation context

The supplied CVSS vector describes network-reachable, low-complexity, unauthenticated availability impact. However, KEV is false and the provided sources do not establish active exploitation or a public exploit. Practical trigger conditions and resource-exhaustion rate are not documented in the bundle.

Researcher notes

No CWE is assigned in the supplied record. The flaw is a lock-scope race causing a dentry reference leak, not a documented memory-corruption or code-execution primitive. Four stable-kernel fix commits are provided. Exact affected-version boundaries require confirmation from kernel or distribution advisories.

Mitigation direction

  • Install a vendor-supported kernel update containing the applicable cited stable fix.
  • Check distribution security guidance to map packaged kernel versions to the upstream fixes.
  • Prioritize systems actively mounting SMB shares, especially availability-sensitive servers.
  • If patching is delayed, assess whether unnecessary SMB client access can be temporarily disabled.

Validation and detection

  • Inventory kernel versions across systems that use Linux SMB mounts.
  • Identify hosts using kernel SMB directory caching and lease functionality.
  • Verify distributor changelogs include the applicable upstream fix commit.
  • After updating, confirm the running kernel matches the remediated package.
  • Monitor affected hosts for unusual reference growth or availability degradation.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37954 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2025-37954Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux81ba10959970d15c388bf29866b01b62f387e6a3, 81ba10959970d15c388bf29866b01b62f387e6a3, 81ba10959970d15c388bf29866b01b62f387e6a3, 81ba10959970d15c388bf29866b01b62f387e6a3, 436be190fbf81e5d84040dabf9cb7be06a94dc5d, 6.5.10unaffected
LinuxLinux6.6, 0, 6.6.91, 6.12.29, 6.14.7, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.