Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-40105— vfs: Don't leak disconnected dentries on umount

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未正确处理断开连接的dentry，可能导致内存泄漏。

CVSS 7.8 · High EPSS 0.17% · P5

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux f1ee616214cb22410e939d963bbb2349c2570f02< b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4 affected
f1ee616214cb22410e939d963bbb2349c2570f02< 20863bb7fbb016379f8227122edfabc5c799bc79 affected
f1ee616214cb22410e939d963bbb2349c2570f02< 8004d4b8cbf1bd68a23c160d57287e177c82cc69 affected
f1ee616214cb22410e939d963bbb2349c2570f02< 7e0c8aaf4e28918abded547a5147c7d52c4af7d2 affected
f1ee616214cb22410e939d963bbb2349c2570f02< cebfbf40056a4d858b2a3ca59a69936d599bd209 affected
f1ee616214cb22410e939d963bbb2349c2570f02< 620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b affected
f1ee616214cb22410e939d963bbb2349c2570f02< eadc49999fa994d6fbd70c332bd5d5051cc42261 affected
f1ee616214cb22410e939d963bbb2349c2570f02< 56094ad3eaa21e6621396cc33811d8f72847a834 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-40105

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vfs: Don't leak disconnected dentries on umount
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh_raw() will then try to connect this dentry to the dentry tree through reconnect_path(). It may happen for various reasons (such as corrupted fs or race with rename) that the call to lookup_one_unlocked() in reconnect_one() will fail to find the dentry we are trying to reconnect and instead create a new dentry under the parent. Now this dentry will not be marked as disconnected although the parent still may well be disconnected (at least in case this inconsistency happened because the fs is corrupted and .. doesn't point to the real parent directory). This creates inconsistency in disconnected flags but AFAICS it was mostly harmless. At least until commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") which removed adding of most disconnected dentries to sb->s_anon list. Thus after this commit cleanup of disconnected dentries implicitely relies on the fact that dput() will immediately reclaim such dentries. However when some leaf dentry isn't marked as disconnected, as in the scenario described above, the reclaim doesn't happen and the dentries are "leaked". Memory reclaim can eventually reclaim them but otherwise they stay in memory and if umount comes first, we hit infamous "Busy inodes after unmount" bug. Make sure all dentries created under a disconnected parent are marked as disconnected as well.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未正确处理断开连接的dentry，可能导致内存泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux f1ee616214cb22410e939d963bbb2349c2570f02 ~ b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4 -
Linux Linux 4.16 -

II. Public POCs for CVE-2025-40105

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-40105

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-10-30 · 20 CVEs total

CVE-2025-40099 9.4 CRITICAL cifs: parse_dfs_referrals: prevent oob on malformed input
CVE-2025-40095 7.8 HIGH usb: gadget: f_rndis: Refactor bind path to use __free()
CVE-2025-40104 7.8 HIGH ixgbevf: fix mailbox API compatibility by negotiating supported features
CVE-2025-40096 7.8 HIGH drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
CVE-2025-40094 7.8 HIGH usb: gadget: f_acm: Refactor bind path to use __free()
CVE-2025-40093 7.8 HIGH usb: gadget: f_ecm: Refactor bind path to use __free()
CVE-2025-40092 7.8 HIGH usb: gadget: f_ncm: Refactor bind path to use __free()
CVE-2025-40090 7.5 HIGH ksmbd: fix recursive locking in RPC handle list access
CVE-2025-40087 7.5 HIGH NFSD: Define a proc_layoutcommit for the FlexFiles layout type
CVE-2025-40088 7.1 HIGH hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
CVE-2025-40091 ixgbe: fix too early devlink_free() in ixgbe_remove()
CVE-2025-40086 drm/xe: Don't allow evicting of BOs in same VM in array of VM binds
CVE-2025-40089 cxl/features: Add check for no entries in cxl_feature_info
CVE-2025-40097 ALSA: hda: Fix missing pointer check in hda_component_manager_init function
CVE-2025-40098 ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()
CVE-2025-40101 btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST
CVE-2025-40100 btrfs: do not assert we found block group item when creating free space tree
CVE-2025-40102 KVM: arm64: Prevent access to vCPU events before init
CVE-2025-40103 smb: client: Fix refcount leak for cifs_sb_tlink

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-40105

No comments yet

Leave a comment