LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40320: smb: client: fix potential cfid UAF in smb2_query_info_compound

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential cfid UAF in smb2_query_info_compound When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free. Reinitialize cfid to NULL under the replay label. Example trace (trimmed): refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110 [...] RIP: 0010:refcount_warn_saturate+0x9c/0x110 [...] Call Trace: <TASK> smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? step_into+0x10d/0x690 ? __legitimize_path+0x28/0x60 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmem_cache_alloc+0x18a/0x340 ? getname_flags+0x46/0x1e0 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfs_by_dentry+0x67/0x90 vfs_statfs+0x16/0xd0 user_statfs+0x54/0xa0 __do_sys_statfs+0x20/0x50 do_syscall_64+0x58/0x80

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A retry error in the Linux SMB client can leave a pointer referencing freed memory. Later cleanup may reuse that stale pointer, causing kernel memory corruption or a system crash. The supplied record rates the issue critical, but it does not establish that attackers can reliably achieve code execution.

Executive priority

Treat as an urgent kernel maintenance issue for systems using Linux SMB clients, especially critical servers. First establish actual CIFS use and obtain distribution guidance because the supplied affected-version list is not sufficiently clear for package-level decisions. Accelerate validated kernel updates, while avoiding claims of active exploitation or confirmed remote code execution.

Technical view

During smb2_query_info_compound() replay, cfid could retain a value freed during the first attempt. Subsequent cleanup could dereference or decrement the stale object, producing a use-after-free and refcount underflow in the CIFS kernel module. The documented correction resets cfid to NULL at the replay label.

Likely exposure

Exposure is limited to Linux systems running an affected kernel and using the CIFS/SMB client where the vulnerable query retry path occurs. The supplied version data identifies 6.8, 6.6.117, 6.12.58, 6.17.8, and 6.18 as affected, but its mixed commit and version entries require vendor-specific confirmation.

Exploitation context

The supplied record reports no CISA KEV listing and provides no evidence of active exploitation or a public exploit. It documents a kernel warning and use-after-free trace. Although the supplied CVSS is 9.8 with a network vector, the available evidence does not explain a reliable remote attack path or demonstrated impact beyond the memory-safety failure.

Researcher notes

The evidence supports a replay-path lifetime bug involving cfid and later cleanup. The trace demonstrates refcount underflow consistent with use-after-free. Stable commits provide the authoritative code correction. Further assessment should determine retry preconditions, attacker influence over SMB responses, and practical consequences, but should not infer exploitability solely from the 9.8 score.

Mitigation direction

  • Inventory Linux systems that mount or access SMB shares through the CIFS client.
  • Check distribution advisories for fixed kernel packages containing the referenced upstream correction.
  • Prioritize kernel updates on SMB-dependent servers and high-availability systems.
  • If updates are unavailable, assess whether CIFS usage can be temporarily reduced without disrupting operations.
  • Reboot into the corrected kernel after installation, following normal change-control procedures.

Validation and detection

  • Record each system's running kernel version and distribution package release.
  • Confirm whether the CIFS module is present or SMB shares are mounted.
  • Map installed kernels against distribution advisories and the referenced stable commits.
  • After updating, verify the corrected kernel is running, not merely installed.
  • Monitor kernel logs for CIFS refcount underflow or use-after-free warnings.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40320 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2025-40320Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux433042a91f9373241307725b52de573933ffedbf, 4f1fffa2376922f3d1d506e49c0fd445b023a28e, 4f1fffa2376922f3d1d506e49c0fd445b023a28e, 4f1fffa2376922f3d1d506e49c0fd445b023a28e, 6.6.32unaffected
LinuxLinux6.8, 0, 6.6.117, 6.12.58, 6.17.8, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.