CVE-2025-68226: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68226 is a Use-After-Free (UAF) vulnerability in the Linux kernel's SMB client subsystem, specifically within the cfids_invalidation_worker() function. It results from an incomplete backport of commit bdb596ceb4b7 ("smb: client: fix potential UAF in smb2_close_cached_fid()"), which missed converting one kref_put() call to close_cached_dir(). The vulnerability was published on December 16, 2025, and affects Linux kernel versions between 6.17.8 and 6.17.10 (commit range bdb596ceb4b7 to abd29b6e17a9). The EPSS score is approximately 0.018% (very low), and no CVSS base score has been assigned (Feedly, ENISA EUVD).

The root cause is an incomplete backport introducing a Use-After-Free condition (CWE-416) in the Linux kernel SMB client's cached file ID invalidation worker. When cfids_invalidation_worker() executes, a kref_put() call that should have been replaced with close_cached_dir() — as part of the prior UAF fix — was inadvertently left in place. This means the reference count on a cached directory object can be decremented without properly closing it, potentially allowing the object to be freed while still referenced. The fix is tracked in the upstream stable kernel commit abd29b6e17a918fdd68352ce4813e167acc8727e (Feedly, Kernel Fix Commit).

Exploitation of this UAF vulnerability could allow a local attacker or a process with access to the SMB client subsystem to trigger memory corruption, potentially leading to a kernel crash (denial of service) or, in more severe scenarios, privilege escalation or arbitrary code execution in kernel context. The affected scope is limited to Linux systems running the vulnerable kernel versions (6.17.8–6.17.10) with the SMB client in use. Data integrity and system availability are the primary concerns, as kernel-level memory corruption can destabilize the entire system (Feedly).

The fix is available in the upstream Linux stable kernel as commit abd29b6e17a918fdd68352ce4813e167acc8727e, which corrects the incomplete backport by replacing the erroneous kref_put() call with close_cached_dir() in cfids_invalidation_worker(). Administrators should update to a patched kernel version beyond 6.17.10 that includes this fix. As a workaround, systems that do not require SMB client functionality can unload or disable the cifs kernel module to reduce exposure (Kernel Fix Commit, Feedly).