Cloudanix VulnDB

CVE-2025-38711

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Sep 4, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's file-sharing code can freeze the system when certain file-link operations are performed on existing files.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Triggers a deadlock in the Linux kernel SMB server (ksmbd) during smb2_create_link when ReplaceIfExists is set on an existing target name: ksmbd_vfs_kern_path_locked holds the parent directory lock, ksmbd_vfs_remove_file removes the target, then ksmbd_vfs_link attempts to acquire the same lock.

Why it matters to the business

Local authenticated users can cause the SMB server process to hang indefinitely, disrupting file-sharing services and potentially requiring a reboot or service restart on affected Linux systems; widespread impact on servers using the kernel SMB implementation.

How an attack unfolds

An attacker with local access or control of an SMB client issues an SMB2 CREATE request that creates a link with the ReplaceIfExists flag when the target name already exists; the kernel path-locking logic deadlocks before the operation completes, freezing the SMB server thread.

How to fix it

Upgrade the Linux kernel to commit 9d5012ffe14120f978ee34aef4df3d6cb026b7c4 or later; for MinimOS packages update go-md2man and go-md2man-doc to 2.0.7-r3 or newer. Apply vendor kernel updates as soon as available; disable the SMB server if the functionality is not required.

How to confirm the fix worked

Confirm the running kernel contains commit 9d5012ffe14120f978ee34aef4df3d6cb026b7c4 or equivalent backport; verify package versions match the fixed releases; attempt to reproduce the original deadlock scenario in a test environment to ensure the hang no longer occurs.

Typical attack path

  1. Obtain local access or SMB client connectivity to the target system
  2. Issue smb2_create_link (via SMB2 protocol) with ReplaceIfExists set against an existing filename
  3. Trigger the locked-parent-directory path that leads to recursive locking attempt
  4. Cause the ksmbd worker thread to deadlock, resulting in denial of service

How to detect it

Review kernel logs for repeated ksmbd or SMB server thread stalls; look for SMB2 CREATE requests containing ReplaceIfExists flags followed by unresponsive server behavior; correlate with process hangs in ksmbd worker threads.

What your security team should do

  • Prioritize kernel updates on all systems exposing the SMB server
  • Review and restrict local user accounts that can interact with SMB shares
  • Monitor for kernel updates in stable channels and apply within maintenance windows
  • Consider disabling ksmbd if SMB server functionality is not essential

The record

In the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 linux 0 No fix
Debian:13 linux 0 6.12.43-1
Debian:14 linux 0 6.16.3-1
Linux Kernel 5.15.0 5.15.190
Mageia:9 kernel 0 6.6.105-1.mga9
Mageia:9 kernel-linus 0 6.6.105-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.10-10.mga9
Mageia:9 kmod-xtables-addons 0 3.24-86.mga9
Mageia:9 mageia-repos 0 9-4.mga9
Mageia:9 meta-task 0 9-4.mga9

Related vulnerabilities