CVE-2025-37954

What it actually does

Race condition in SMB client open_cached_dir allows a pre-existing cfid to race with lease break handling, causing the function to treat a valid cached directory as newly allocated and leak a dentry reference when allocation precedes queued lease break work.

Why it matters to the business

Linux systems using SMB client mounts may experience memory leaks, reference count imbalances, or crashes during directory operations under concurrent lease break conditions, increasing operational risk in file-sharing environments with moderate urgency due to kernel-wide exposure.

How an attack unfolds

An attacker with network access to an SMB server triggers lease breaks while a client performs cached directory opens; the race allows the client to mishandle the cfid, leaking references that an adversary can chain with other kernel primitives for memory corruption or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 2ed98e89ebc2e1bc73534dc3c18cb7843a889ff9 or apply the equivalent stable backport; rebuild and reboot affected systems, prioritizing those with active SMB client usage.

How to confirm the fix worked

Confirm the kernel source contains the cfid_list_lock extension around find_or_create_cached_dir and result validation; test by reproducing concurrent lease break and open_cached_dir sequences under load and verify no dentry reference leaks via kmemleak or slab tracing.

Typical attack path

1. Establish SMB connection and negotiate leases on directories
2. Force concurrent lease break notifications from server
3. Trigger find_or_create_cached_dir during the window before lease break work runs
4. Exploit resulting dentry reference leak for further memory manipulation

How to detect it

Review kernel logs for dentry reference warnings or slab allocation anomalies around SMB lease break events; inspect auditd or eBPF traces for unusual open_cached_dir and cfid operations coinciding with network lease notifications.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all SMB client systems
• Monitor EPSS trend and re-evaluate if exploitation maturity increases
• Restrict SMB client exposure to untrusted servers until patched
• Audit for downstream packages depending on the vulnerable kernel