CVE-2025-39825

MediumCVSS 4.7/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix race with concurrent opens in rename(2)

Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file.

Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2025
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-398267.0In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in structCVE-2025-398275.5In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implCVE-2025-398287.8In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot CVE-2025-398295.5In the Linux kernel, the following vulnerability has been resolved: trace/fgraph: Fix the warning caused by missing unregister notifier ThCVE-2025-39837.2A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical. Affected by this vulnerability is anCVE-2025-398305.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path In thCVE-2025-398315.5In the Linux kernel, the following vulnerability has been resolved: fbnic: Move phylink resume out of service_task and into open/close TheCVE-2025-398325.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdepCVE-2025-398335.5In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix warning when deleting uninitialized timer With CONFCVE-2025-398345.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error fCVE-2025-398357.8In the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (akaCVE-2025-398367.8In the Linux kernel, the following vulnerability has been resolved: efi: stmm: Fix incorrect buffer allocation method The communication bu
CVE-2025-39825: Medium severity, CVSS 4.7 | Vulnix