CVE-2025-38527

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free. Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.

• CWE-416

• https://git.kernel.org/stable/c/09bce2138a30ef10d8821c8c3f73a4ab7a5726bcPatch
• https://git.kernel.org/stable/c/0a4eec84d4d2c4085d4ed8630fd74e4b39033c1bPatch
• https://git.kernel.org/stable/c/2baaf5bbab2ac474c4f92c10fcb3310f824db995Patch
• https://git.kernel.org/stable/c/4256a483fe58af66a46cbf3dc48ff26e580d3308Patch
• https://git.kernel.org/stable/c/705c79101ccf9edea5a00d761491a03ced314210Patch
• https://git.kernel.org/stable/c/da11bd4b697b393a207f19a2ed7d382a811a3ddcPatch
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlMailing List, Third Party Advisory

Published

Aug 16, 2025

Last Modified

Jul 30, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-38521In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2025-38522In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38523In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38524In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2025-38525In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38526In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38528In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38529In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2025-3853The WPshop 2 – E-Commerce plugin for WordPress is vulnerable…6.5
• CVE-2025-38530In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2025-38531In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38532In the Linux kernel, the following vulnerability has been re…5.5