CVE-2025-40320: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40320 is a use-after-free (UAF) vulnerability in the Linux kernel's SMB client (cifs module), specifically within the smb2_query_info_compound() function. When this function retries a request, a previously allocated cfid (cached file ID) pointer may have already been freed during the first attempt; because cfid was not reset to NULL under the replay label, subsequent cleanup operations act on a stale pointer, triggering a UAF condition. The vulnerability was disclosed on December 8, 2025, and affects Linux kernel versions from 6.8 up to the patched releases (6.6.117, 6.12.58, 6.17.8, and 6.18). It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a use-after-free memory error (CWE-416) in the Linux kernel's CIFS/SMB2 client implementation. In smb2_query_info_compound(), when a retry (replay) occurs after a failed first attempt, the cfid pointer is not reinitialized to NULL before re-entering the retry path. If the cfid was freed during the first attempt, the retry path operates on a dangling pointer, leading to a refcount underflow and potential UAF. The vulnerability is triggered locally by a low-privileged user invoking filesystem operations such as statfs() on an SMB-mounted share, as evidenced by the kernel call trace: cifs_statfs → smb311_queryfs → smb2_queryfs → smb2_query_info_compound. The fix reinitializes cfid to NULL under the replay label (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation of this vulnerability can result in high confidentiality, integrity, and availability impact on the affected system, as reflected in the CVSS score. A local attacker with low privileges could leverage the UAF condition to read sensitive kernel memory, corrupt kernel data structures, or crash the system (kernel panic). In worst-case scenarios, this class of vulnerability can be chained with other primitives to achieve local privilege escalation (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-40320. The vulnerability requires local access with low privileges and high attack complexity, limiting its immediate exploitability. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

The Linux kernel maintainers have released patches addressing this vulnerability in stable branches: versions 6.6.117, 6.12.58, 6.17.8, and 6.18. For Red Hat Enterprise Linux 10, the fix is included in RHSA-2026:18134. Administrators should update to a patched kernel version as soon as possible. As a temporary workaround where patching is not immediately feasible, restricting or disabling SMB/CIFS mounts for untrusted local users can reduce exposure (Red Hat Bugzilla, Red Hat Errata).