CVE-2025-40320

What it actually does

Use-after-free in Linux kernel SMB client (cifs) smb2_query_info_compound when a cfid allocated on first attempt is freed during retry but not reset under the replay label, allowing later cleanup to dereference a stale pointer and trigger refcount underflow.

Why it matters to the business

Systems mounting SMB shares may experience kernel panics, crashes, or potential local privilege escalation during file system operations such as statfs, increasing downtime and risk of compromise especially on servers or workstations with network file access.

How an attack unfolds

An attacker with local access or the ability to influence SMB server responses triggers a retry path in smb2_query_info_compound (for example via network interruption or crafted server replies during queryfs/statfs), causing the stale cfid to be used after free and resulting in the refcount warning and UAF condition.

How to fix it

Upgrade the Linux kernel to a fixed version such as 6.6.117 or apply the commit 939c4e33005e2a56ea8fcedddf0da92df864bd3b; for affected Ubuntu packages update libsass to 3.4.8-1ubuntu0.1~esm1 (18.04) or 3.5.5-4 (20.04) where applicable and reboot.

How to confirm the fix worked

Verify running kernel version is at or above the fixed release; reproduce a statfs operation on an SMB mount and confirm absence of refcount underflow warnings in dmesg; inspect cifs module source for the NULL reset under the replay label.

Typical attack path

1. Mount an SMB share and trigger a statfs or queryfs operation
2. Induce a retry condition in smb2_query_info_compound
3. Previously allocated cfid is freed but pointer remains non-NULL
4. Cleanup code dereferences the stale cfid leading to UAF
5. Kernel logs refcount underflow and may panic or allow further exploitation

How to detect it

Search kernel logs (dmesg, syslog) for refcount underflow warnings accompanied by call traces mentioning smb2_query_info_compound, smb2_queryfs, cifs_statfs, or the cifs module; look for processes performing statfs on SMB mounts near the time of the warning.

• refcount_t: underflow; use-after-free
• smb2_query_info_compound+0x29c/0x5c0 [cifs
• smb2_queryfs+0x6a/0xf0 [cifs
• cifs_statfs+0x9f/0x2b0 [cifs

What your security team should do

• Prioritize kernel updates on all systems with SMB/CIFS mounts within the next patch cycle
• Monitor for refcount warnings in kernel logs on SMB-using hosts
• Consider disabling unnecessary SMB client features if updates cannot be applied immediately
• Test fixed kernels in staging before broad deployment due to file system impact