CVE-2025-39929 (GCVE-0-2025-39929)

Vulnerability from cvelistv5 – Published: 2025-10-04 07:30 – Updated: 2026-08-05 12:06
VLAI
Title
smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path During tests of another unrelated patch I was able to trigger this error: Objects remaining on __kmem_cache_shutdown()
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < 5aa69aabcb275a8012265233c7694076ce1d9102 (git)
Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < aa4cf7615328eae44f3b4bf5f4fde3fb390c27c6 (git)
Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < 3d7c075c878ac844e33c43e506c2fa27ac7e9689 (git)
Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < e7b7a93879558e77d950f1ff9a6f3daa385b33df (git)
Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < 922338efaad63cfe30d459dfc59f9d69ff93ded4 (git)
Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < 0991418bf98f191d0c320bd25245fcffa1998c7e (git)
Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.154 , ≤ 6.1.* (semver)
Unaffected: 6.6.108 , ≤ 6.6.* (semver)
Unaffected: 6.12.49 , ≤ 6.12.* (semver)
Unaffected: 6.16.9 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:43:05.033Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smbdirect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5aa69aabcb275a8012265233c7694076ce1d9102",
              "status": "affected",
              "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
              "versionType": "git"
            },
            {
              "lessThan": "aa4cf7615328eae44f3b4bf5f4fde3fb390c27c6",
              "status": "affected",
              "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
              "versionType": "git"
            },
            {
              "lessThan": "3d7c075c878ac844e33c43e506c2fa27ac7e9689",
              "status": "affected",
              "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
              "versionType": "git"
            },
            {
              "lessThan": "e7b7a93879558e77d950f1ff9a6f3daa385b33df",
              "status": "affected",
              "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
              "versionType": "git"
            },
            {
              "lessThan": "922338efaad63cfe30d459dfc59f9d69ff93ded4",
              "status": "affected",
              "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
              "versionType": "git"
            },
            {
              "lessThan": "0991418bf98f191d0c320bd25245fcffa1998c7e",
              "status": "affected",
              "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
              "versionType": "git"
            },
            {
              "lessThan": "daac51c7032036a0ca5f1aa419ad1b0471d1c6e0",
              "status": "affected",
              "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smbdirect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.154",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path\n\nDuring tests of another unrelated patch I was able to trigger this\nerror: Objects remaining on __kmem_cache_shutdown()"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The affected code is the CIFS client\u0027s SMB Direct (RDMA) transport handshake, driven end-to-end by the remote SMB server peer over iWARP/RoCE/InfiniBand; the peer resets the connection and forces the `smbd_reconnect()` \u2192 `_smbd_get_connection()` \u2192 `smbd_negotiate()` path that leaks. This matches the network-reachable scoring already applied to other client-side smbdirect flaws (CVE-2025-39932, CVE-2025-39933).\nAC:L - The attacker owns both sides of the timing: it initiates the RDMA disconnect that drives the QP toward the error/teardown states in which `ib_post_recv()` fails, and it can force reconnect cycles indefinitely, retrying until it lands in the window between `RDMA_CM_EVENT_ESTABLISHED` and `smbd_post_recv()`. The reporter hit the condition during ordinary testing, and unlimited retries mean no condition is truly outside attacker influence.\nPR:N - The SMB Direct negotiate exchange sits beneath SMB2 NEGOTIATE and SESSION_SETUP, so no credentials, capability, or account on the client is validated anywhere along the path to `smbd_negotiate()`. The remote peer needs no privileges on the target to reset the transport and drive the failing handshake.\nUI:N - Against an already-mounted SMB Direct share \u2014 persistent deployment state, not victim participation \u2014 the client\u0027s demultiplex thread enters `smbd_reconnect()` \u2192 `_smbd_get_connection()` \u2192 `smbd_negotiate()` automatically whenever the peer drops the connection, with no user action at any point.\nS:U - The leaked `smbdirect_recv_io` object and the un-destroyed per-connection kmem_cache are kernel-internal allocations belonging to the same security authority as the faulting code. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The orphaned buffer is never freed and never reused, so there is no use-after-free, no out-of-bounds read, and no stale DMA mapping (`sge.length` is 0 on the DMA-error path and already unmapped on the `ib_post_recv` path). Nothing is disclosed to the remote attacker.\nI:N - No memory is corrupted or overwritten \u2014 the object simply remains allocated with no dangling reference, so the attacker gains no write primitive and no ability to modify kernel or user data.\nA:H - Every occurrence fires a `slab_bug()` splat plus `WARN()` in `kmem_cache_destroy()`, tainting the kernel and panicking outright on `panic_on_warn=1` systems, and leaves the whole per-connection `smbdirect_recv_io_%p` kmem_cache permanently un-destroyed. Because the remote peer can force unlimited reconnect attempts, the unreclaimable slab caches and their pages accumulate without bound toward memory exhaustion."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:08.383Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5aa69aabcb275a8012265233c7694076ce1d9102"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa4cf7615328eae44f3b4bf5f4fde3fb390c27c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d7c075c878ac844e33c43e506c2fa27ac7e9689"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7b7a93879558e77d950f1ff9a6f3daa385b33df"
        },
        {
          "url": "https://git.kernel.org/stable/c/922338efaad63cfe30d459dfc59f9d69ff93ded4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0991418bf98f191d0c320bd25245fcffa1998c7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/daac51c7032036a0ca5f1aa419ad1b0471d1c6e0"
        }
      ],
      "title": "smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39929",
    "datePublished": "2025-10-04T07:30:55.153Z",
    "dateReserved": "2025-04-16T07:20:57.147Z",
    "dateUpdated": "2026-08-05T12:06:08.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39929",
      "date": "2026-09-23",
      "epss": "0.00306",
      "percentile": "0.23633"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-05T01:02:06.000Z",
      "cve": "CVE-2025-39929",
      "id": "msrc_CVE-2025-39929",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39929.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smbdirect.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5aa69aabcb275a8012265233c7694076ce1d9102",
                    "status": "affected",
                    "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "aa4cf7615328eae44f3b4bf5f4fde3fb390c27c6",
                    "status": "affected",
                    "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3d7c075c878ac844e33c43e506c2fa27ac7e9689",
                    "status": "affected",
                    "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e7b7a93879558e77d950f1ff9a6f3daa385b33df",
                    "status": "affected",
                    "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "922338efaad63cfe30d459dfc59f9d69ff93ded4",
                    "status": "affected",
                    "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0991418bf98f191d0c320bd25245fcffa1998c7e",
                    "status": "affected",
                    "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "daac51c7032036a0ca5f1aa419ad1b0471d1c6e0",
                    "status": "affected",
                    "version": "f198186aa9bbd60fae7a2061f4feec614d880299",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smbdirect.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.16"
                  },
                  {
                    "lessThan": "4.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.154",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.108",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.49",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.5",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.5",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.5",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.5",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.5",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0F31848E-0ABB-4DCA-8DBD-F87E2F0E43DE",
                    "versionEndExcluding": "6.1.154",
                    "versionStartIncluding": "4.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A7E8EAEE-7731-4996-9578-696255D61EA2",
                    "versionEndExcluding": "6.6.108",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CAA033E9-A2C5-4976-A83E-9804D8FB827F",
                    "versionEndExcluding": "6.12.49",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "638DD910-1189-4F5E-98BF-2D436B695112",
                    "versionEndExcluding": "6.16.9",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "5A4516A6-C12E-42A4-8C0E-68AEF3264504",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path\n\nDuring tests of another unrelated patch I was able to trigger this\nerror: Objects remaining on __kmem_cache_shutdown()"
          }
        ],
        "id": "CVE-2025-39929",
        "lastModified": "2026-07-30T06:23:57.927",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-04T08:15:44.620",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0991418bf98f191d0c320bd25245fcffa1998c7e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3d7c075c878ac844e33c43e506c2fa27ac7e9689"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5aa69aabcb275a8012265233c7694076ce1d9102"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/922338efaad63cfe30d459dfc59f9d69ff93ded4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/aa4cf7615328eae44f3b4bf5f4fde3fb390c27c6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/daac51c7032036a0ca5f1aa419ad1b0471d1c6e0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e7b7a93879558e77d950f1ff9a6f3daa385b33df"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:08:32+00:00",
      "cve": "CVE-2025-39929",
      "id": "CVE-2025-39929",
      "initial_release_date": "2025-10-04T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service due to memory leak in SMB client",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39929.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:56:59Z",
      "cve": "CVE-2025-39929",
      "id": "CVE-2025-39929",
      "initial_release_date": "2025-10-05T02:52:41Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "465",
      "product_status:recommended": "23",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39929",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39929.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.