5.5

CVE-2025-38711

smb/server: avoid deadlock when linking with ReplaceIfExists

In the Linux kernel, the following vulnerability has been resolved:

smb/server: avoid deadlock when linking with ReplaceIfExists

If smb2_create_link() is called with ReplaceIfExists set and the name
does exist then a deadlock will happen.

ksmbd_vfs_kern_path_locked() will return with success and the parent
directory will be locked.  ksmbd_vfs_remove_file() will then remove the
file.  ksmbd_vfs_link() will then be called while the parent is still
locked.  It will try to lock the same parent and will deadlock.

This patch moves the ksmbd_vfs_kern_path_unlock() call to *before*
ksmbd_vfs_link() and then simplifies the code, removing the file_present
flag variable.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.15 < 5.15.190
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.149
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.103
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.43
Linux ≫ Linux Kernel Version >= 6.13 < 6.15.11
Linux ≫ Linux Kernel Version >= 6.16 < 6.16.2
Debian ≫ Debian Linux Version11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.016
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

https://git.kernel.org/stable/c/9d5012ffe14120f978ee34aef4df3d6cb026b7c4
Patch
https://git.kernel.org/stable/c/ac98d54630d5b52e3f684d872f0d82c06c418ea9
Patch
https://git.kernel.org/stable/c/1e858a7a51c7b8b009d8f246de7ceb7743b44a71
Patch
https://git.kernel.org/stable/c/814cfdb6358d9b84fcbec9918c8f938cc096a43a
Patch
https://git.kernel.org/stable/c/a7dddd62578c2eb6cb28b8835556a121b5157323
Patch
https://git.kernel.org/stable/c/a726fef6d7d4cfc365d3434e3916dbfe78991a33
Patch
https://git.kernel.org/stable/c/d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694
Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Third Party Advisory
Mailing List
https://cert-portal.siemens.com/productcert/html/ssa-032379.html