Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38527— smb: client: fix use-after-free in cifs_oplock_break

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于smb客户端在cifs_oplock_break中存在释放后使用，可能导致崩溃。

CVSS 9.8 · Critical EPSS 0.43% · P36

Possible ATT&CK Techniques 1 AI

T1211 · Exploitation for Stealth

Affected Version Matrix 24

VendorProduct Version RangeStatus
Linux Linux b98749cac4a695f084a5ff076f4510b23e353ecd< 4256a483fe58af66a46cbf3dc48ff26e580d3308 affected
b98749cac4a695f084a5ff076f4510b23e353ecd< 0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b affected
b98749cac4a695f084a5ff076f4510b23e353ecd< 2baaf5bbab2ac474c4f92c10fcb3310f824db995 affected
b98749cac4a695f084a5ff076f4510b23e353ecd< 09bce2138a30ef10d8821c8c3f73a4ab7a5726bc affected
b98749cac4a695f084a5ff076f4510b23e353ecd< da11bd4b697b393a207f19a2ed7d382a811a3ddc affected
b98749cac4a695f084a5ff076f4510b23e353ecd< 705c79101ccf9edea5a00d761491a03ced314210 affected
2429fcf06d3cb962693868ab0a927c9038f12a2d affected
1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12 affected
… +16 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38527

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
smb: client: fix use-after-free in cifs_oplock_break
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free. Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于smb客户端在cifs_oplock_break中存在释放后使用，可能导致崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b98749cac4a695f084a5ff076f4510b23e353ecd ~ 4256a483fe58af66a46cbf3dc48ff26e580d3308 -
Linux Linux 5.1 -

II. Public POCs for CVE-2025-38527

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38527

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-38527 (2)

Same Patch Batch · Linux · 2025-08-16 · 59 CVEs total

CVE-2025-38533 9.8 CRITICAL net: libwx: fix the using of Rx buffer DMA
CVE-2025-38552 9.4 CRITICAL mptcp: plug races between subflow fail and subflow creation
CVE-2023-3867 9.1 CRITICAL ksmbd: fix out of bounds read in smb2_sess_setup
CVE-2023-4515 9.1 CRITICAL ksmbd: validate command request size
CVE-2023-32249 9.1 CRITICAL ksmbd: not allow guest user on multichannel
CVE-2025-38512 8.8 HIGH wifi: prevent A-MSDU attacks in mesh networks
CVE-2025-38511 8.8 HIGH drm/xe/pf: Clear all LMTT pages on alloc
CVE-2023-3865 8.1 HIGH ksmbd: fix out-of-bound read in smb2_write
CVE-2023-4130 8.1 HIGH ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
CVE-2025-38539 7.8 HIGH tracing: Add down_write(trace_event_sem) when adding trace event
CVE-2025-38550 7.8 HIGH ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
CVE-2025-38536 7.8 HIGH net: airoha: fix potential use-after-free in airoha_npu_get()
CVE-2025-38542 7.8 HIGH net: appletalk: Fix device refcount leak in atrtr_create()
CVE-2025-38532 7.8 HIGH net: libwx: properly reset Rx ring descriptor
CVE-2025-38502 7.8 HIGH bpf: Fix oob access in cgroup local storage
CVE-2025-38523 7.5 HIGH cifs: Fix the smbd_response slab to allow usercopy
CVE-2025-38514 7.5 HIGH rxrpc: Fix oops due to non-existence of prealloc backlog struct
CVE-2025-38501 7.5 HIGH ksmbd: limit repeated connections from clients with the same IP
CVE-2025-38525 7.5 HIGH rxrpc: Fix irq-disabled in local_bh_enable()
CVE-2025-38524 7.5 HIGH rxrpc: Fix recv-recv race of completed call

Showing top 20 of 59 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38527

No comments yet

Leave a comment