{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40105", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.165Z", "datePublished": "2025-10-30T09:48:09.674Z", "dateUpdated": "2026-08-05T12:07:50.794Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:50.794Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfs: Don't leak disconnected dentries on umount\n\nWhen user calls open_by_handle_at() on some inode that is not cached, we\nwill create disconnected dentry for it. If such dentry is a directory,\nexportfs_decode_fh_raw() will then try to connect this dentry to the\ndentry tree through reconnect_path(). It may happen for various reasons\n(such as corrupted fs or race with rename) that the call to\nlookup_one_unlocked() in reconnect_one() will fail to find the dentry we\nare trying to reconnect and instead create a new dentry under the\nparent. Now this dentry will not be marked as disconnected although the\nparent still may well be disconnected (at least in case this\ninconsistency happened because the fs is corrupted and .. doesn't point\nto the real parent directory). This creates inconsistency in\ndisconnected flags but AFAICS it was mostly harmless. At least until\ncommit f1ee616214cb (\"VFS: don't keep disconnected dentries on d_anon\")\nwhich removed adding of most disconnected dentries to sb->s_anon list.\nThus after this commit cleanup of disconnected dentries implicitely\nrelies on the fact that dput() will immediately reclaim such dentries.\nHowever when some leaf dentry isn't marked as disconnected, as in the\nscenario described above, the reclaim doesn't happen and the dentries\nare \"leaked\". Memory reclaim can eventually reclaim them but otherwise\nthey stay in memory and if umount comes first, we hit infamous \"Busy\ninodes after unmount\" bug. Make sure all dentries created under a\ndisconnected parent are marked as disconnected as well." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is entered through the `open_by_handle_at()` syscall (and the attacker must also drive the `umount` that converts the dentry leak into the busy-inode/superblock use-after-free), both of which require local system access. The nfsd file-handle path reaches the same code remotely but only produces the reclaimable leak, since a remote client cannot trigger the unmount.\nAC:L - With a malicious FUSE server (or a crafted/corrupt filesystem image, as in the syzbot reproducer) the attacker fully controls `get_parent()`, the readdir entry name, and the `lookup()` result, so the `tmp != dentry` mismatch in `reconnect_one()` is produced deterministically with no race to win. Even the alternate rename-race variant is driven by both sides under attacker control.\nPR:L - `may_decode_fh()` accepts `ns_capable(s_user_ns, CAP_SYS_ADMIN)` for `O_DIRECTORY` handles since v6.11, and FUSE is `FS_USERNS_MOUNT` with export ops enabled by a server-supplied flag, so an ordinary unprivileged user can satisfy every gate inside their own user namespace on their own mount. No real root in the initial namespace is needed.\nUI:N - The attacker performs the mount, the `open_by_handle_at()` call, and the unmount entirely themselves within their own user/mount namespace. No victim action is involved.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or hypervisor boundary crossed. This is standard in-kernel impact.\nC:H - The leaked dentries survive `generic_shutdown_super()` with `d_sb` pointing at a freed `super_block`, and the poisoned inodes remain on a torn-down superblock — a use-after-free that lets an attacker who sprays the freed slab read back kernel memory through subsequent dcache walks. Per UAF scoring this is High.\nI:H - The dangling `d_sb`/`d_op` and `list_lru_destroy()`d LRU heads mean later `__dentry_kill()`/`iput_final()` operate on reallocated memory, including indirect calls through `d_op->d_release`/`s_op` in a possibly unloaded module — a controllable write/control-flow primitive. Use-after-free is scored High for integrity.\nA:H - Unmount reliably produces the `VFS: Busy inodes after unmount` `CHECK_DATA_CORRUPTION` WARN — a `BUG()` with `CONFIG_BUG_ON_DATA_CORRUPTION` and an immediate panic with `panic_on_warn` — and the deliberately installed `VFS_PTR_POISON` guarantees a later oops when the leaked inodes are reclaimed." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/dcache.c" ], "versions": [ { "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4", "status": "affected", "versionType": "git" }, { "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "20863bb7fbb016379f8227122edfabc5c799bc79", "status": "affected", "versionType": "git" }, { "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "8004d4b8cbf1bd68a23c160d57287e177c82cc69", "status": "affected", "versionType": "git" }, { "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "7e0c8aaf4e28918abded547a5147c7d52c4af7d2", "status": "affected", "versionType": "git" }, { "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "cebfbf40056a4d858b2a3ca59a69936d599bd209", "status": "affected", "versionType": "git" }, { "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b", "status": "affected", "versionType": "git" }, { "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "eadc49999fa994d6fbd70c332bd5d5051cc42261", "status": "affected", "versionType": "git" }, { "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "56094ad3eaa21e6621396cc33811d8f72847a834", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/dcache.c" ], "versions": [ { "version": "4.16", "status": "affected" }, { "version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.196", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.158", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.114", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.55", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.5", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.4.301" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.10.246" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.15.196" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6.114" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.12.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.17.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4" }, { "url": "https://git.kernel.org/stable/c/20863bb7fbb016379f8227122edfabc5c799bc79" }, { "url": "https://git.kernel.org/stable/c/8004d4b8cbf1bd68a23c160d57287e177c82cc69" }, { "url": "https://git.kernel.org/stable/c/7e0c8aaf4e28918abded547a5147c7d52c4af7d2" }, { "url": "https://git.kernel.org/stable/c/cebfbf40056a4d858b2a3ca59a69936d599bd209" }, { "url": "https://git.kernel.org/stable/c/620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b" }, { "url": "https://git.kernel.org/stable/c/eadc49999fa994d6fbd70c332bd5d5051cc42261" }, { "url": "https://git.kernel.org/stable/c/56094ad3eaa21e6621396cc33811d8f72847a834" } ], "title": "vfs: Don't leak disconnected dentries on umount", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:43:20.789Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ] } ] } }