Security readout for executives and security teams
Plain-English summary
A race condition in the Linux SMB client can occur when one process renames a file while another opens the rename target. A local, low-privileged user could potentially trigger serious confidentiality, integrity, or availability impact. Exposure depends on affected kernels, SMB client use, and concurrent file operations.
Executive priority
Treat as a high-priority kernel update for multi-user systems and SMB-dependent servers. Accelerate remediation where untrusted local users can access SMB mounts. Internet-only exposure is not indicated by the local attack vector, so prioritize by actual SMB client use and local access paths.
Technical view
During rename handling, the SMB client closes deferred handles, waits for I/O, and marks existing handles deleted. This creates a window for concurrent opens on the target dentry. The kernel fix unhashes that dentry before these operations, preventing new opens during the vulnerable window.
Likely exposure
Prioritize Linux systems using SMB-mounted storage where untrusted or low-privileged local users can perform file operations. The supplied record identifies affected versions including 5.13 through several 6.x releases, but its version data is ambiguous; confirm applicability through kernel or distribution advisories.
Exploitation context
The CVSS vector requires local access and low privileges, with no user interaction. The supplied record is not in CISA KEV, and the sources provided do not establish active exploitation or public weaponization. Practical triggering also appears to require concurrent SMB rename and open activity.
Researcher notes
The record describes a synchronization flaw around target dentries and concurrent opens, but supplies no CWE or demonstrated exploitation details. Validate backports by code change or vendor changelog, not version numbers alone. The upstream remediation unhashes the target dentry before rename cleanup to close the race window.
Mitigation direction
- Install the corrected kernel package supplied by the system vendor or Linux distribution.
- Confirm the update includes the applicable upstream stable fix for the running kernel branch.
- Where immediate patching is impossible, restrict untrusted local access to SMB-mounted paths.
- Review Debian or appliance-vendor advisories when those products are deployed.
Validation and detection
- Inventory running kernel versions and identify hosts using the Linux SMB client.
- Compare vendor package changelogs against CVE-2025-39825 and the referenced stable commits.
- After updating, reboot if required and verify the corrected kernel is running.
- Run safe SMB rename-and-open regression tests in an isolated environment.
- Monitor affected hosts for crashes or abnormal SMB file-operation failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39825 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c9e7de284da0be5b44dbe79d71573f9f7f9b144cCVE reference, Linux
- https://git.kernel.org/stable/c/24b9ed739c8c5b464d983e12cf308982f3ae93c2CVE reference, Linux
- https://git.kernel.org/stable/c/c9991af5e09924f6f3b3e6996a5e09f9504b4358CVE reference, Linux
- https://git.kernel.org/stable/c/289f945acb20b9b54fe4d13895e44aa58965ddb2CVE reference, Linux
- https://git.kernel.org/stable/c/d84291fc7453df7881a970716f8256273aca5747CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.