CVE-2025-68809

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: vfs: fix race on m_flags in vfs_cache

ksmbd maintains delete-on-close and pending-delete state in

ksmbd_inode->m_flags. In vfs_cache.c this field is accessed under

inconsistent locking: some paths read and modify m_flags under

ci->m_lock while others do so without taking the lock at all.

Examples:

- ksmbd_query_inode_status() and __ksmbd_inode_close() use

ci->m_lock when checking or updating m_flags.

- ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(),

ksmbd_clear_inode_pending_delete() and ksmbd_fd_set_delete_on_close()

used to read and modify m_flags without ci->m_lock.

This creates a potential data race on m_flags when multiple threads

open, close and delete the same file concurrently. In the worst case

delete-on-close and pending-delete bits can be lost or observed in an

inconsistent state, leading to confusing delete semantics (files that

stay on disk after delete-on-close, or f

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References