Security readout for executives and security teams
Plain-English summary
A Linux SMB client cleanup race can leave background RDMA work running after related resources are destroyed. This can trigger unsafe kernel behavior and potentially severe confidentiality, integrity, and availability impact under the supplied CVSS assessment. Exposure appears limited to affected kernels using SMB Direct/RDMA paths. The bundle provides no evidence of exploitation in the wild.
Executive priority
Treat this as an urgent targeted kernel remediation for Linux systems using SMB Direct/RDMA, especially critical file-service clients. Do not assume every Linux SMB system is remotely exploitable from the CVSS score alone. Identify relevant configurations, obtain distribution-specific fixed packages, test, and deploy promptly. The supplied exploitation evidence does not support broader emergency action.
Technical view
smbd_destroy() could release connection state while post_send_credits_work remained pending or could be queued again. The observed RXE path called rxe_post_recv() after rdma_destroy_qp(), indicating a teardown synchronization flaw in the CIFS SMB Direct client. The stable change synchronously disables the work item before destruction. The bundle supplies no CWE or demonstrated security impact beyond the kernel warning and call trace.
Likely exposure
Linux hosts running listed affected kernels—4.16, 6.12.49, 6.16.9, and 6.17—and exercising CIFS SMB Direct over RDMA are the clearest candidates. The bundle also contains an ambiguous “0” version and repeated commit identifiers, so distribution-specific package status requires verification. These sources do not establish exposure for ordinary SMB use outside the RDMA path.
Exploitation context
The bundle marks KEV false, and no supplied source reports active exploitation, public exploit code, or a proven remote attack path. The issue was reproduced with software RXE and produced a kernel warning after RDMA queue-pair destruction. Although CVSS 9.8 models unauthenticated network exploitation and full impact, the bundle does not document trigger conditions or confirmed consequences validating that worst case.
Researcher notes
The core invariant is that post_send_credits_work must be disabled and drained before smbd_destroy() releases associated state. The trace shows work queued from put_receive_buffer() during ib_drain_qp(), later reaching smbd_post_recv() after rdma_destroy_qp(). Commit-to-release mapping, reachable remote inputs, privilege boundaries, and concrete memory-corruption consequences are absent; these gaps materially limit exploitability conclusions.
Mitigation direction
- Apply a vendor-supported kernel containing the applicable linked stable fix after confirming the correct distribution package.
- Prioritize affected hosts that actively use CIFS SMB Direct over RDMA.
- Consult Linux distributor guidance for fixed versions; the bundle provides no package mapping or validated workaround.
- Test kernel updates against file-service workloads, then deploy through the normal controlled update process.
Validation and detection
- Inventory running kernel versions and compare them with the listed affected versions and distributor advisories.
- Confirm whether CIFS and SMB Direct/RDMA are enabled and exercised on each candidate host.
- Verify the installed kernel source or package changelog includes the applicable stable fix.
- Review kernel logs for CIFS, smbd, RDMA, RXE, or queue-pair teardown warnings.
- After updating and rebooting, confirm the running kernel is the intended fixed package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39932 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6ae90a2baf923e85eb037b636aa641250bf4220fCVE reference, Linux
- https://git.kernel.org/stable/c/3fabb1236f2e3ad78d531be0a4ad9f4a4ccdda87CVE reference, Linux
- https://git.kernel.org/stable/c/d9dcbbcf9145b68aa85c40947311a6907277e097CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.