CVE-2025-38321

What it actually does

Under low-memory conditions, close_all_cached_dirs() cannot move dentries to a separate list for dput() after dropping locks, producing a kernel BUG: Dentry still in use during CIFS unmount and a warning in fs/dcache.c:1536.

Why it matters to the business

Linux systems using CIFS/SMB shares risk kernel warnings, instability, or crashes on unmount when memory is constrained; high ecosystem prevalence across kernels and distributions amplifies operational disruption risk despite low EPSS.

How an attack unfolds

An attacker first exhausts memory on a target Linux system then triggers CIFS unmount operations, causing close_all_cached_dirs to fail and surface the dentry BUG; active campaigns involving Linux kernel privilege escalation and September 2025 exploitation activity may combine this with related flaws for denial-of-service effects.

How to fix it

Upgrade to fixed versions: Kernel (Linux) 6.6.95, linux-lts (Alpaquita:stream) 6.12.41-r0, or the stable GIT commit b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da; apply patches immediately given 474 days since publication and downstream dependents.

How to confirm the fix worked

Verify running kernel version against fixed releases; reproduce low-memory CIFS unmount and confirm absence of the dcache.c umount_check warning and dentry BUG; monitor for the new error log introduced by the fix.

Typical attack path

1. Exhaust available kernel memory on the target host
2. Trigger unmount of one or more CIFS mounts
3. Force close_all_cached_dirs to encounter allocation failure
4. Observe resulting BUG and dentry-in-use warning

How to detect it

Search system logs for CIFS VFS messages containing 'Out of memory while dropping dentries' and kernel BUG reports referencing umount_check in fs/dcache.c; correlate with unmount events of cifs mounts; factor in observed activity from Advanced Spyware Campaign and September 2025 Active Exploitation Campaigns.

• CIFS: VFS: .* Out of memory while dropping dentries
• BUG: Dentry .* still in use .* unmount of cifs cifs
• WARNING: CPU: .* at fs/dcache.c:1536 umount_check

What your security team should do

• Apply the listed fixed kernel versions or commit without delay
• Monitor memory pressure on systems hosting CIFS mounts
• Incorporate the dentry error log pattern into detection rules
• Review threat actor activity around Linux kernel privilege-escalation campaigns for combined exploitation risk