CVE-2025-68226

A flaw was found in the Linux kernel’s SMB client implementation (fs/smb/client/cached_dir.c). An earlier commit intended to fix a potential use-after-free in smb2_close_cached_fid() was incompletely backported, resulting in a missing kref_put() call in the cfids_invalidation_worker() function. Under certain conditions, this can lead to a use-after-free of a reference counted object, potentially causing kernel instability or denial of service.

A use-after-free flaw was found in the Linux kernel SMB client implementation (fs/smb/client/cached_dir.c). An earlier commit intended to fix a potential use-after-free in smb2_close_cached_fid() was incompletely backported, leaving a kref_put() call in cfids_invalidation_worker() that should have been converted to close_cached_dir(). Under certain conditions, this can lead to a use-after-free of a reference-counted object, potentially causing kernel instability or a denial of service.

Red Hat Product Security has rated this issue as Moderate (CVSS:3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), since exploitation requires local access and privileges and the impact is limited to availability. The upstream CVE record carries a higher score (CVSS 8.8, network attack vector with high confidentiality and integrity impact), which does not match the technical nature of this flaw as established by the upstream fix commit.

This issue affects the kernel and kernel-rt components in Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10, where the fix is deferred to a future update given the moderate, local, availability-only impact of the flaw. The vulnerable code is not present in Red Hat Enterprise Linux 6, 7, or 8, or in Red Hat In-Vehicle OS 1.1, so those products are not affected. The residual risk of the deferral is that a local user could trigger a use-after-free during invalidation of cached SMB directory handles, potentially crashing the kernel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the cifs kernel module from loading. This can be achieved by creating a blacklist file.

1. Create a file named /etc/modprobe.d/blacklist-cifs.conf with the following content:

   blacklist cifs
   install cifs /bin/true
   

2. Regenerate the initramfs:

   dracut -f -v
   

3. Reboot the system for the changes to take effect.

Note that blacklisting the cifs module will disable SMB client functionality, which may impact systems relying on it for network file sharing.