What’s Vulnerable › Vulnerabilities

CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2)

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-16 · updated 2026-10-19
• Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 5.13 before 6.1.150; from 6.2 before 6.6.104; from 6.7 before 6.12.45; from 6.13 before 6.16.5; 6.17-rc1 — fixed in 6.1.150, 6.12.45, 6.16.5, 6.6.104

How to fix

Upgrade to a fixed version: Linux kernel 6.1.150, 6.12.45, 6.16.5, 6.6.104. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/24b9ed739c8c5b464d983e12cf308982f3ae93c2
• https://git.kernel.org/stable/c/289f945acb20b9b54fe4d13895e44aa58965ddb2
• https://git.kernel.org/stable/c/c9991af5e09924f6f3b3e6996a5e09f9504b4358
• https://git.kernel.org/stable/c/c9e7de284da0be5b44dbe79d71573f9f7f9b144c
• https://git.kernel.org/stable/c/d84291fc7453df7881a970716f8256273aca5747
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html

Get alerted when CVE-2025-39825 or the next vulnerability affects your stack