Race Condition Vulnerability in Linux Kernel's SMB Client - DEBIAN-CVE-2025-37954
Summary
DEBIAN-CVE-2025-37954: In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease b... Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the SMB (Server Message Block) client, which is used for network file sharing. The issue arises from a race condition that can lead to improper handling of directory caching, potentially resulting in resource leaks.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2025-37954 is a race condition in the SMB client of the Linux kernel. It occurs when a valid cached file identifier (cfid) is returned from the function find_or_create_cached_dir, which may race with a lease break. This race condition leads to the open_cached_dir function mistakenly treating the cached directory as newly constructed, causing a leak of a directory entry reference if the allocation happens before the queued lease break work is executed. This can result in resource exhaustion and instability in the system.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The DEBIAN-CVE-2025-37954 vulnerability presents a significant risk due to a race condition in the Linux kernel's SMB client. It is essential for users to update their systems to the patched version to prevent potential resource leaks and maintain system stability.
See every vulnerability recorded for linux →
FAQ
It is a vulnerability in the Linux kernel's SMB client that involves a race condition leading to potential resource leaks.
If exploited, this vulnerability can lead to resource exhaustion, causing instability and performance issues in the system.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible.
Detailed information can be found in the official Debian security advisory and vulnerability databases.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
