CVE-2025-68809: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-68809 is a race condition vulnerability in the Linux kernel's ksmbd (SMB server) vfs_cache component, caused by inconsistent locking of the m_flags field in ksmbd_inode. The flaw was published on January 13, 2026, and affects Linux kernel versions used in systems running ksmbd, including Microsoft's Azure Linux 3 kernel prior to azl3_kernel_6.6.119.3-3. It carries a CVSS v3.1 base score of 6.3 (Medium), requiring local access and low privileges with high attack complexity (Red Hat CVE, Microsoft MSRC).

The root cause is a concurrent access (race condition) vulnerability classified as CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). The m_flags field in ksmbd_inode, which tracks delete-on-close and pending-delete state, is accessed under ci->m_lock in some code paths (e.g., ksmbd_query_inode_status(), __ksmbd_inode_close()) but without any locking in others (e.g., ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(), ksmbd_clear_inode_pending_delete(), ksmbd_fd_set_delete_on_close()). When multiple threads concurrently open, close, and delete the same file via the SMB server, this inconsistency creates a data race where delete-on-close or pending-delete bits can be lost or observed in an inconsistent state. The fix adds ci->m_lock protection uniformly to all helpers that read or modify m_flags (Red Hat CVE).

Successful exploitation of this race condition can result in two primary failure modes: files marked for delete-on-close may incorrectly persist on disk after deletion is requested, or files still in active use by other processes may be prematurely deleted. These outcomes can lead to data loss, file system inconsistency, and denial of service conditions on systems running the ksmbd SMB server. The integrity and availability impacts are rated High, while there is no direct confidentiality impact (Red Hat CVE, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and high attack complexity, as it depends on precise timing of concurrent file operations through the ksmbd SMB server.

Apply available kernel patches immediately. Microsoft has released a patched version for Azure Linux 3 (azl3_kernel_6.6.119.3-3 or later) (Microsoft MSRC). Ubuntu has issued multiple security notices addressing this CVE, including USN-8177-1, USN-8177-2, USN-8179-1 through USN-8179-4, USN-8183-1, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, and USN-8265-1 (Ubuntu USN-8177-1). As a workaround where patching is not immediately possible, consider disabling ksmbd if SMB server functionality is not required, or restricting access to the SMB service to trusted users only.