CVE-2025-37954

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Avoid race in open_cached_dir with lease breaks

A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't consider it valid, and thinks it's newly-constructed. This leaks a dentry reference if the allocation occurs before the queued lease break work runs.

Avoid the race by extending holding the cfid_list_lock across find_or_create_cached_dir and when the result is checked.

Fixes a race in SMB client cached directory handling causing dentry ref leaks. The security impact is limited. Only affects systems under active SMB usage with directory caching and lease breaks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.