CVE-2025-40320

The vulnerability resides in the Linux kernel's CIFS/SMB client, specifically in the smb2_query_info_compound function. When the function retries its operation (e.g., due to a transient failure) via the replay label, it fails to reset the cached file identifier (cfid) pointer to NULL. If the first attempt allocated and subsequently freed a cfid structure, the retry path will operate on a stale pointer, leading to a use-after-free condition. This is evidenced by a kernel refcount underflow warning and a stack trace showing the smb2_query_info_compound function calling into the refcount subsystem [1].

The attack surface for exploitation is local, requiring an attacker to have the ability to mount a CIFS/SMB share and trigger file system operations that call smb2_query_info_compound, such as statfs(). The attacker must be able to cause the function's first attempt to fail and then succeed on a retry, which is a realistic scenario on unreliable networks or with crafted SMB server responses. No additional authentication beyond that needed to mount the share is required; the vulnerability can be triggered by a regular user accessing the mounted filesystem.

If successfully exploited, an attacker could cause a denial of service (system crash) due to memory corruption, or potentially escalate privileges if the freed memory is reallocated and controlled by the attacker. The most likely impact is a kernel panic, as seen in the trace with a warning and potential system instability.

The fix is included in the Linux kernel stable branch, commit 939c4e2a56ea8fcedddf0da92df864bd3b, which reinitializes cfid to NULL under the replay label. Users should apply this patch or update to a kernel version containing it. There is no public evidence of active exploitation or inclusion in the CISA KEV catalog at this time.