Strix
26.1K

CVE-2025-40328

HIGHCVSS 8.8/10EPSS 0.20%

Last modified

CVE-2025-40328 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
0.20%

10.5th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ebe98f1447bbccf8228335c62d86af02a0ed23f7, < cb52d9c86d70298de0ab7c7953653898cbc0efd6; >= ebe98f1447bbccf8228335c62d86af02a0ed23f7, < 065bd62412271a2d734810dd50336cae88c54427; >= ebe98f1447bbccf8228335c62d86af02a0ed23f7, < bdb596ceb4b7c3f28786a33840263728217fbcf5; >= ebe98f1447bbccf8228335c62d86af02a0ed23f7, < 734e99623c5b65bf2c03e35978a0b980ebc3c2f8
LinuxLinux6.1

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2025-40328?
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap.
How severe is CVE-2025-40328?
CVE-2025-40328 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.
How do I fix CVE-2025-40328?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-40328?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST