CVE-2025-39825

What it actually does

Race condition in the SMB client rename path that leaves a window for concurrent opens on the target file while deferred closes, I/O completion, and handle invalidation occur.

Why it matters to the business

Local processes on systems using SMB shares may experience unexpected file access failures or kernel instability during rename operations, increasing operational risk on Linux deployments that mount remote file systems.

How an attack unfolds

An attacker with local access on an affected Linux system triggers a rename(2) on an SMB-mounted file while simultaneously issuing open calls from other threads or processes; the race allows the new opens to bypass the intended deletion marking, potentially leading to use-after-free or inconsistent handle state that can be chained with other kernel primitives for privilege escalation.

How to fix it

Update the Linux kernel to the commit c9e7de284da0be5b44dbe79d71573f9f7f9b144c or later; rebuild and reboot systems using the fixed tree. For packaged distributions apply the equivalent stable update when available.

How to confirm the fix worked

Confirm the running kernel contains commit c9e7de284da0be5b44dbe79d71573f9f7f9b144c via git describe or uname -r against the fixed version; re-test concurrent rename and open workloads on SMB mounts to verify absence of the race window.

Typical attack path

1. Obtain local code execution on a Linux host with SMB client mounts
2. Identify or create a file on the SMB share suitable for rename
3. Race concurrent open(2) calls against a rename(2) operation
4. Exploit resulting handle inconsistency or memory corruption

How to detect it

Review kernel logs and audit records for unexpected SMB client errors or dentry-related warnings around rename syscalls; look for process activity that performs rapid open/rename sequences on the same SMB path.

What your security team should do

• Prioritize kernel updates on all systems that mount SMB shares
• Monitor upstream stable branches for backported fixes
• Restrict local unprivileged access on multi-user or container hosts until patched