Use-After-Free Vulnerability in Linux Kernel SMB Client

CVE-2025-40320

What is CVE-2025-40320?

A vulnerability in the Linux kernel's SMB client could lead to a use-after-free condition during file operation retries. Specifically, when the smb2_query_info_compound() function attempts to retry, a client identifier (cfid) that was previously allocated may have been freed during the first attempt. Since cfid isn't reset during this replay, subsequent cleanups can access a dangling pointer, risking data corruption or system instability. The issue has been addressed by reinitializing cfid to NULL during the replay process to mitigate the risks associated with stale pointers.

References