GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68809 (GCVE-0-2025-68809)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:29 – Updated: 2026-08-05 12:11
VLAI
Title
ksmbd: vfs: fix race on m_flags in vfs_cache
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-delete state in ksmbd_inode->m_flags. In vfs_cache.c this field is accessed under inconsistent locking: some paths read and modify m_flags under ci->m_lock while others do so without taking the lock at all. Examples: - ksmbd_query_inode_status() and __ksmbd_inode_close() use ci->m_lock when checking or updating m_flags. - ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(), ksmbd_clear_inode_pending_delete() and ksmbd_fd_set_delete_on_close() used to read and modify m_flags without ci->m_lock. This creates a potential data race on m_flags when multiple threads open, close and delete the same file concurrently. In the worst case delete-on-close and pending-delete bits can be lost or observed in an inconsistent state, leading to confusing delete semantics (files that stay on disk after delete-on-close, or files that disappear while still in use). Fix it by: - Making ksmbd_query_inode_status() look at m_flags under ci->m_lock after dropping inode_hash_lock. - Adding ci->m_lock protection to all helpers that read or modify m_flags (ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(), ksmbd_clear_inode_pending_delete(), ksmbd_fd_set_delete_on_close()). - Keeping the existing ci->m_lock protection in __ksmbd_inode_close(), and moving the actual unlink/xattr removal outside the lock. This unifies the locking around m_flags and removes the data race while preserving the existing delete-on-close behaviour.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f44158485826c076335d6860d35872271a83791d , < 5adad9727a815c26013b0d41cfee92ffa7d4037c (git)
Affected: f44158485826c076335d6860d35872271a83791d , < ccc78781041589ea383e61d5d7a1e9a31b210b93 (git)
Affected: f44158485826c076335d6860d35872271a83791d , < ee63729760f5b61a66f345c54dc4c7514e62383d (git)
Affected: f44158485826c076335d6860d35872271a83791d , < 991f8a79db99b14c48d20d2052c82d65b9186cad (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5adad9727a815c26013b0d41cfee92ffa7d4037c",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "ccc78781041589ea383e61d5d7a1e9a31b210b93",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "ee63729760f5b61a66f345c54dc4c7514e62383d",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "991f8a79db99b14c48d20d2052c82d65b9186cad",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: vfs: fix race on m_flags in vfs_cache\n\nksmbd maintains delete-on-close and pending-delete state in\nksmbd_inode-\u003em_flags. In vfs_cache.c this field is accessed under\ninconsistent locking: some paths read and modify m_flags under\nci-\u003em_lock while others do so without taking the lock at all.\n\nExamples:\n\n - ksmbd_query_inode_status() and __ksmbd_inode_close() use\n   ci-\u003em_lock when checking or updating m_flags.\n - ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(),\n   ksmbd_clear_inode_pending_delete() and ksmbd_fd_set_delete_on_close()\n   used to read and modify m_flags without ci-\u003em_lock.\n\nThis creates a potential data race on m_flags when multiple threads\nopen, close and delete the same file concurrently. In the worst case\ndelete-on-close and pending-delete bits can be lost or observed in an\ninconsistent state, leading to confusing delete semantics (files that\nstay on disk after delete-on-close, or files that disappear while still\nin use).\n\nFix it by:\n\n - Making ksmbd_query_inode_status() look at m_flags under ci-\u003em_lock\n   after dropping inode_hash_lock.\n - Adding ci-\u003em_lock protection to all helpers that read or modify\n   m_flags (ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(),\n   ksmbd_clear_inode_pending_delete(), ksmbd_fd_set_delete_on_close()).\n - Keeping the existing ci-\u003em_lock protection in __ksmbd_inode_close(),\n   and moving the actual unlink/xattr removal outside the lock.\n\nThis unifies the locking around m_flags and removes the data race while\npreserving the existing delete-on-close behaviour."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The race is reachable through ksmbd SMB2 requests received over TCP, normally port 445, including CREATE, SET_INFO, QUERY_INFO, and CLOSE operations.\nAC:L - An attacker can control both sides by opening multiple handles to the same inode and issuing concurrent requests or disconnects that ksmbd processes on separate workers.\nPR:N - Although a valid session, writable tree connection, and delete-capable handle are normally required, ksmbd supports unauthenticated guest sessions and guest-writable shares. Such deployments let a remote attacker reach the race without possessing credentials.\nUI:N - The attacker can create the necessary handles, race the requests, and trigger final close without any victim action.\nS:U - The affected SMB server, filesystem operations, and resulting data impact remain within the host kernel\u0027s security authority.\nC:N - The raced field is an aligned unsigned flag word, and the affected operations neither expose data nor corrupt pointers, object lifetimes, or adjacent memory.\nI:H - Lost or stale pending-delete and delete-on-close bits can cause attacker-selected files, directories, or alternate data streams to be unlinked despite the intended state, producing persistent data loss in a critical writable share.\nA:H - Unexpected and repeatable deletion of operational files while they are in use can persistently make shared storage or dependent services unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:40.534Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5adad9727a815c26013b0d41cfee92ffa7d4037c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccc78781041589ea383e61d5d7a1e9a31b210b93"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee63729760f5b61a66f345c54dc4c7514e62383d"
        },
        {
          "url": "https://git.kernel.org/stable/c/991f8a79db99b14c48d20d2052c82d65b9186cad"
        }
      ],
      "title": "ksmbd: vfs: fix race on m_flags in vfs_cache",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68809",
    "datePublished": "2026-01-13T15:29:15.817Z",
    "dateReserved": "2025-12-24T10:30:51.047Z",
    "dateUpdated": "2026-08-05T12:11:40.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68809",
      "date": "2026-09-17",
      "epss": "0.00516",
      "percentile": "0.4274"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68809\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:03.080\",\"lastModified\":\"2026-07-30T06:24:46.520\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: vfs: fix race on m_flags in vfs_cache\\n\\nksmbd maintains delete-on-close and pending-delete state in\\nksmbd_inode-\u003em_flags. In vfs_cache.c this field is accessed under\\ninconsistent locking: some paths read and modify m_flags under\\nci-\u003em_lock while others do so without taking the lock at all.\\n\\nExamples:\\n\\n - ksmbd_query_inode_status() and __ksmbd_inode_close() use\\n   ci-\u003em_lock when checking or updating m_flags.\\n - ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(),\\n   ksmbd_clear_inode_pending_delete() and ksmbd_fd_set_delete_on_close()\\n   used to read and modify m_flags without ci-\u003em_lock.\\n\\nThis creates a potential data race on m_flags when multiple threads\\nopen, close and delete the same file concurrently. In the worst case\\ndelete-on-close and pending-delete bits can be lost or observed in an\\ninconsistent state, leading to confusing delete semantics (files that\\nstay on disk after delete-on-close, or files that disappear while still\\nin use).\\n\\nFix it by:\\n\\n - Making ksmbd_query_inode_status() look at m_flags under ci-\u003em_lock\\n   after dropping inode_hash_lock.\\n - Adding ci-\u003em_lock protection to all helpers that read or modify\\n   m_flags (ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(),\\n   ksmbd_clear_inode_pending_delete(), ksmbd_fd_set_delete_on_close()).\\n - Keeping the existing ci-\u003em_lock protection in __ksmbd_inode_close(),\\n   and moving the actual unlink/xattr removal outside the lock.\\n\\nThis unifies the locking around m_flags and removes the data race while\\npreserving the existing delete-on-close behaviour.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nksmbd: vfs: corregir condici\u00f3n de carrera en m_flags en vfs_cache\\n\\nksmbd mantiene el estado de eliminaci\u00f3n al cerrar y eliminaci\u00f3n pendiente en ksmbd_inode-\u0026gt;m_flags. En vfs_cache.c, este campo es accedido bajo un bloqueo inconsistente: algunas rutas leen y modifican m_flags bajo ci-\u0026gt;m_lock mientras que otras lo hacen sin tomar el bloqueo en absoluto.\\n\\nEjemplos:\\n\\n - ksmbd_query_inode_status() y __ksmbd_inode_close() usan ci-\u0026gt;m_lock al verificar o actualizar m_flags.\\n - ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(), ksmbd_clear_inode_pending_delete() y ksmbd_fd_set_delete_on_close() sol\u00edan leer y modificar m_flags sin ci-\u0026gt;m_lock.\\n\\nEsto crea una potencial condici\u00f3n de carrera de datos en m_flags cuando m\u00faltiples hilos abren, cierran y eliminan el mismo archivo concurrentemente. En el peor de los casos, los bits de eliminaci\u00f3n al cerrar y eliminaci\u00f3n pendiente pueden perderse u observarse en un estado inconsistente, lo que lleva a sem\u00e1nticas de eliminaci\u00f3n confusas (archivos que permanecen en el disco despu\u00e9s de la eliminaci\u00f3n al cerrar, o archivos que desaparecen mientras a\u00fan est\u00e1n en uso).\\n\\nSolucionarlo mediante:\\n\\n - Haciendo que ksmbd_query_inode_status() examine m_flags bajo ci-\u0026gt;m_lock despu\u00e9s de liberar inode_hash_lock.\\n - A\u00f1adiendo protecci\u00f3n ci-\u0026gt;m_lock a todas las funciones auxiliares que leen o modifican m_flags (ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(), ksmbd_clear_inode_pending_delete(), ksmbd_fd_set_delete_on_close()).\\n - Manteniendo la protecci\u00f3n ci-\u0026gt;m_lock existente en __ksmbd_inode_close(), y moviendo la eliminaci\u00f3n real de unlink/xattr fuera del bloqueo.\\n\\nEsto unifica el bloqueo alrededor de m_flags y elimina la condici\u00f3n de carrera de datos mientras se preserva el comportamiento existente de eliminaci\u00f3n al cerrar.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/vfs_cache.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f44158485826c076335d6860d35872271a83791d\",\"lessThan\":\"5adad9727a815c26013b0d41cfee92ffa7d4037c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f44158485826c076335d6860d35872271a83791d\",\"lessThan\":\"ccc78781041589ea383e61d5d7a1e9a31b210b93\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f44158485826c076335d6860d35872271a83791d\",\"lessThan\":\"ee63729760f5b61a66f345c54dc4c7514e62383d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f44158485826c076335d6860d35872271a83791d\",\"lessThan\":\"991f8a79db99b14c48d20d2052c82d65b9186cad\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/vfs_cache.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5adad9727a815c26013b0d41cfee92ffa7d4037c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/991f8a79db99b14c48d20d2052c82d65b9186cad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ccc78781041589ea383e61d5d7a1e9a31b210b93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ee63729760f5b61a66f345c54dc4c7514e62383d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-21T11:44:18+00:00",
      "cve": "CVE-2025-68809",
      "id": "CVE-2025-68809",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: Remote race condition leads to data integrity issues and denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68809.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:41:27Z",
      "cve": "CVE-2025-68809",
      "id": "CVE-2025-68809",
      "initial_release_date": "2026-01-15T00:25:51Z",
      "product_status:known_not_affected": "457",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68809",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68809.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.