CVE-2025-39692: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-39692 affects the Linux kernel and involves a vulnerability in the SMB server component. The issue was disclosed on September 5, 2025, and relates to improper handling of RDMA workqueue cleanup in the ksmbd module (NVD).

The vulnerability stems from an incorrect sequence of operations in the SMB server's RDMA handling, specifically where destroyworkqueue(smbdirectwq) is called before stopsessions(). This timing issue results in existing connections attempting to use smbdirectwq after it has been destroyed, leading to NULL pointer dereferencing. The vulnerability has been assigned a CVSS v3 base score of 5.5, indicating moderate severity (AttackerKB).

When exploited, this vulnerability can cause existing SMB connections to attempt accessing a NULL pointer, potentially leading to system crashes or denial of service conditions. The impact is primarily focused on systems running the Linux kernel with the ksmbd RDMA functionality enabled (Rapid7).

The vulnerability has been resolved by splitting the ksmbdrdmastoplistening() function out of ksmbdrdma_destroy(), ensuring proper sequencing of operations during the cleanup process. System administrators should apply the latest kernel updates that include this fix (NVD).