In the Linux kernel, the following vulnerability has been resolved:
smb: Log an error when closeallcached_dirs fails
Under low-memory conditions, closeallcached_dirs() can't move the dentries to a separate list to dput() them once the locks are dropped. This will result in a "Dentry still in use" error, so add an error message that makes it clear this is what happened:
[ 495.281119] CIFS: VFS: \otters.example.com\share Out of memory while dropping dentries [ 495.281595] ------------[ cut here ]------------ [ 495.281887] BUG: Dentry ffff888115531138{i=78,n=/} still in use (2) [unmount of cifs cifs] [ 495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0
Also, bail out of looping through all tcons as soon as a single allocation fails, since we're already in trouble, and kmalloc() attempts for subseqeuent tcons are likely to fail just like the first one did.
[
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cached_dir.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"103633997112457240836580438237926070024",
"157008745507368531047569692238148086415",
"86223366436786227435940950502075284527",
"324556177735598304988951461213863653725",
"299017403564495946351281861067333904047",
"218502330778767060855864577152597382188",
"255336579671761023798496955716792029527",
"95556865035608028367660335771241896023"
]
},
"id": "CVE-2025-38321-22be51f1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2182743a8b4969481f64aec4908ff162e8a206c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cached_dir.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"103633997112457240836580438237926070024",
"157008745507368531047569692238148086415",
"86223366436786227435940950502075284527",
"324556177735598304988951461213863653725",
"299017403564495946351281861067333904047",
"218502330778767060855864577152597382188",
"255336579671761023798496955716792029527",
"95556865035608028367660335771241896023"
]
},
"id": "CVE-2025-38321-2e9e1def",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cached_dir.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"103633997112457240836580438237926070024",
"157008745507368531047569692238148086415",
"86223366436786227435940950502075284527",
"324556177735598304988951461213863653725",
"299017403564495946351281861067333904047",
"218502330778767060855864577152597382188",
"255336579671761023798496955716792029527",
"95556865035608028367660335771241896023"
]
},
"id": "CVE-2025-38321-33a45d19",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43f26094d6702e494e800532c3f1606e7a68eb30",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cached_dir.c",
"function": "close_all_cached_dirs"
},
"digest": {
"length": 1033.0,
"function_hash": "63340377433690116581563586608756456571"
},
"id": "CVE-2025-38321-88e190ce",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4479db143390bdcadc1561292aab579cdfa9f6c6",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cached_dir.c",
"function": "close_all_cached_dirs"
},
"digest": {
"length": 1033.0,
"function_hash": "63340377433690116581563586608756456571"
},
"id": "CVE-2025-38321-ae20e3ae",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43f26094d6702e494e800532c3f1606e7a68eb30",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cached_dir.c",
"function": "close_all_cached_dirs"
},
"digest": {
"length": 1033.0,
"function_hash": "63340377433690116581563586608756456571"
},
"id": "CVE-2025-38321-bced2a21",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2182743a8b4969481f64aec4908ff162e8a206c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cached_dir.c",
"function": "close_all_cached_dirs"
},
"digest": {
"length": 1033.0,
"function_hash": "63340377433690116581563586608756456571"
},
"id": "CVE-2025-38321-ca00c8b5",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cached_dir.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"103633997112457240836580438237926070024",
"157008745507368531047569692238148086415",
"86223366436786227435940950502075284527",
"324556177735598304988951461213863653725",
"299017403564495946351281861067333904047",
"218502330778767060855864577152597382188",
"255336579671761023798496955716792029527",
"95556865035608028367660335771241896023"
]
},
"id": "CVE-2025-38321-fa586ff5",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4479db143390bdcadc1561292aab579cdfa9f6c6",
"signature_version": "v1"
}
]