CVE-2025-68809

Vulnerability

In the Linux kernel's ksmbd (SMB server) implementation, a race condition exists in the vfs_cache component. The m_flags field in ksmbd_inode is used to track delete-on-close and pending-delete state. However, some code paths access and modify m_flags without proper locking, while others use the ci->m_lock spinlock. This inconsistent locking creates a data race when multiple threads concurrently open, close, or delete the same file [1].

Exploitation

The race can be triggered by an attacker with the ability to perform concurrent file operations over SMB. Specifically, operations that set or clear delete-on-close and pending-delete flags (such as ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(), ksmbd_clear_inode_pending_delete(), and ksmbd_fd_set_delete_on_close()) were previously unprotected by the ci->m_lock [2]. This allows an attacker to cause the flags to be observed in an inconsistent state or lost entirely.

Impact

A successful exploitation of this race condition can result in confusing delete semantics. Files that should be deleted on close may remain on disk, or files that are still in use may be deleted prematurely. In worst-case scenarios, this could lead to data corruption or denial of service for SMB clients.

Mitigation

The vulnerability is fixed in Linux kernel commits that add consistent ci->m_lock protection to all m_flags accesses [1][2]. The fix also ensures that actual unlink and xattr removal operations are performed outside the lock to avoid deadlocks. Users should update to a kernel version containing the fix. As of publication, the vulnerability has not been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.