linux-cve-announce - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091616-CVE-2025-39825-8a7a@gregkh>
Date: Tue, 16 Sep 2025 15:00:31 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2)

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix race with concurrent opens in rename(2)

Besides sending the rename request to the server, the rename process
also involves closing any deferred close, waiting for outstanding I/O
to complete as well as marking all existing open handles as deleted to
prevent them from deferring closes, which increases the race window
for potential concurrent opens on the target file.

Fix this by unhashing the dentry in advance to prevent any concurrent
opens on the target.

The Linux kernel CVE team has assigned CVE-2025-39825 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.1.150 with commit c9e7de284da0be5b44dbe79d71573f9f7f9b144c
	Fixed in 6.6.104 with commit 24b9ed739c8c5b464d983e12cf308982f3ae93c2
	Fixed in 6.12.45 with commit c9991af5e09924f6f3b3e6996a5e09f9504b4358
	Fixed in 6.16.5 with commit 289f945acb20b9b54fe4d13895e44aa58965ddb2
	Fixed in 6.17-rc2 with commit d84291fc7453df7881a970716f8256273aca5747

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-39825
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/client/inode.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c9e7de284da0be5b44dbe79d71573f9f7f9b144c
	https://git.kernel.org/stable/c/24b9ed739c8c5b464d983e12cf308982f3ae93c2
	https://git.kernel.org/stable/c/c9991af5e09924f6f3b3e6996a5e09f9504b4358
	https://git.kernel.org/stable/c/289f945acb20b9b54fe4d13895e44aa58965ddb2
	https://git.kernel.org/stable/c/d84291fc7453df7881a970716f8256273aca5747