CVE-2025-38321

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38321", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.004Z", "datePublished": "2025-07-10T08:14:57.046Z", "dateUpdated": "2026-10-15T21:52:14.275Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:08.577Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Log an error when close_all_cached_dirs fails\n\nUnder low-memory conditions, close_all_cached_dirs() can't move the\ndentries to a separate list to dput() them once the locks are dropped.\nThis will result in a \"Dentry still in use\" error, so add an error\nmessage that makes it clear this is what happened:\n\n[ 495.281119] CIFS: VFS: \\\\otters.example.com\\share Out of memory while dropping dentries\n[ 495.281595] ------------[ cut here ]------------\n[ 495.281887] BUG: Dentry ffff888115531138{i=78,n=/} still in use (2) [unmount of cifs cifs]\n[ 495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0\n\nAlso, bail out of looping through all tcons as soon as a single\nallocation fails, since we're already in trouble, and kmalloc() attempts\nfor subseqeuent tcons are likely to fail just like the first one did."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code runs only in `cifs_kill_sb()` on the local unmount path, and the triggering condition is a local GFP_ATOMIC allocation failure under memory pressure; a remote SMB server can influence how many cached dirs exist but cannot drive the unmount or the OOM.\nAC:L - Memory pressure is directly attacker-inducible and GFP_ATOMIC allocations fail readily under it, and the mount/unmount cycle can be repeated indefinitely, with up to `max_cached_dirs` allocations per tcon per unmount (multiplied further by `multiuser` mounts) giving many independent chances to hit the failure.\nPR:L - A basic unprivileged local account suffices to create the memory pressure, and the unmount is reachable to the same user through the standard `user`/`users` fstab option for SMB shares, setuid `mount.cifs`, or an autofs/systemd idle-expiry unmount; no root or CAP_SYS_ADMIN in the init namespace is required.\nUI:N - On user-mountable shares the attacker performs the mount, the memory exhaustion, and the unmount entirely from their own process, and on automounted shares the expiry unmount happens on a timer with no victim action at all.\nS:U - The leaked dentries, poisoned inodes, and freed superblock are all kernel objects within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - When the tcon is shared with a surviving superblock, the undropped `cfid->dentry` outlives `destroy_super()`, so the later `dput()` reads `dentry->d_sb` fields (`s_dentry_lru`, `s_d_op`, `s_type`) out of a freed kmalloc-2k object the attacker can reoccupy, giving a use-after-free read primitive over sprayed heap contents.\nI:H - The same dangling `dput()` performs list operations on the freed superblock's `s_dentry_lru`, writing into attacker-groomed heap memory, and the VFS additionally overwrites `i_op`/`i_sb`/`i_mapping` of the still-referenced inodes \u2014 a use-after-free write primitive usable for control-flow corruption.\nA:H - The failure deterministically produces `WARN(1, \"BUG: Dentry ... still in use\")` in `umount_check()` (a panic under `panic_on_warn`), then `CHECK_DATA_CORRUPTION()` on busy inodes which is an outright `BUG()` with `CONFIG_BUG_ON_DATA_CORRUPTION=y`, and otherwise poisons the inodes so the subsequent `iput_final()` oopses on `VFS_PTR_POISON`."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cached_dir.c"], "versions": [{"version": "73934e535cffbda1490fa97d82690a0f9aa73e94", "lessThan": "b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da", "status": "affected", "versionType": "git"}, {"version": "548812afd96982a76a93ba76c0582ea670c40d9e", "lessThan": "43f26094d6702e494e800532c3f1606e7a68eb30", "status": "affected", "versionType": "git"}, {"version": "3fa640d035e5ae526769615c35cb9ed4be6e3662", "lessThan": "4479db143390bdcadc1561292aab579cdfa9f6c6", "status": "affected", "versionType": "git"}, {"version": "3fa640d035e5ae526769615c35cb9ed4be6e3662", "lessThan": "a2182743a8b4969481f64aec4908ff162e8a206c", "status": "affected", "versionType": "git"}, {"version": "ff4528bbc82d0d90073751f7b49e7b9e9c7e5638", "status": "affected", "versionType": "git"}, {"version": "6.6.64", "lessThan": "6.6.95", "status": "affected", "versionType": "semver"}, {"version": "6.12.2", "lessThan": "6.12.35", "status": "affected", "versionType": "semver"}, {"version": "6.11.11", "lessThan": "6.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cached_dir.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.64", "versionEndExcluding": "6.6.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.2", "versionEndExcluding": "6.12.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.15.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da"}, {"url": "https://git.kernel.org/stable/c/43f26094d6702e494e800532c3f1606e7a68eb30"}, {"url": "https://git.kernel.org/stable/c/4479db143390bdcadc1561292aab579cdfa9f6c6"}, {"url": "https://git.kernel.org/stable/c/a2182743a8b4969481f64aec4908ff162e8a206c"}], "title": "smb: Log an error when close_all_cached_dirs fails", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38321", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:49:37.462417Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:14.275Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38321", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:49:37.462417Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:49:38.180Z"}}], "cna": {"title": "smb: Log an error when close_all_cached_dirs fails", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code runs only in `cifs_kill_sb()` on the local unmount path, and the triggering condition is a local GFP_ATOMIC allocation failure under memory pressure; a remote SMB server can influence how many cached dirs exist but cannot drive the unmount or the OOM.\nAC:L - Memory pressure is directly attacker-inducible and GFP_ATOMIC allocations fail readily under it, and the mount/unmount cycle can be repeated indefinitely, with up to `max_cached_dirs` allocations per tcon per unmount (multiplied further by `multiuser` mounts) giving many independent chances to hit the failure.\nPR:L - A basic unprivileged local account suffices to create the memory pressure, and the unmount is reachable to the same user through the standard `user`/`users` fstab option for SMB shares, setuid `mount.cifs`, or an autofs/systemd idle-expiry unmount; no root or CAP_SYS_ADMIN in the init namespace is required.\nUI:N - On user-mountable shares the attacker performs the mount, the memory exhaustion, and the unmount entirely from their own process, and on automounted shares the expiry unmount happens on a timer with no victim action at all.\nS:U - The leaked dentries, poisoned inodes, and freed superblock are all kernel objects within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - When the tcon is shared with a surviving superblock, the undropped `cfid->dentry` outlives `destroy_super()`, so the later `dput()` reads `dentry->d_sb` fields (`s_dentry_lru`, `s_d_op`, `s_type`) out of a freed kmalloc-2k object the attacker can reoccupy, giving a use-after-free read primitive over sprayed heap contents.\nI:H - The same dangling `dput()` performs list operations on the freed superblock's `s_dentry_lru`, writing into attacker-groomed heap memory, and the VFS additionally overwrites `i_op`/`i_sb`/`i_mapping` of the still-referenced inodes \u2014 a use-after-free write primitive usable for control-flow corruption.\nA:H - The failure deterministically produces `WARN(1, \"BUG: Dentry ... still in use\")` in `umount_check()` (a panic under `panic_on_warn`), then `CHECK_DATA_CORRUPTION()` on busy inodes which is an outright `BUG()` with `CONFIG_BUG_ON_DATA_CORRUPTION=y`, and otherwise poisons the inodes so the subsequent `iput_final()` oopses on `VFS_PTR_POISON`."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "73934e535cffbda1490fa97d82690a0f9aa73e94", "lessThan": "b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da", "versionType": "git"}, {"status": "affected", "version": "548812afd96982a76a93ba76c0582ea670c40d9e", "lessThan": "43f26094d6702e494e800532c3f1606e7a68eb30", "versionType": "git"}, {"status": "affected", "version": "3fa640d035e5ae526769615c35cb9ed4be6e3662", "lessThan": "4479db143390bdcadc1561292aab579cdfa9f6c6", "versionType": "git"}, {"status": "affected", "version": "3fa640d035e5ae526769615c35cb9ed4be6e3662", "lessThan": "a2182743a8b4969481f64aec4908ff162e8a206c", "versionType": "git"}, {"status": "affected", "version": "ff4528bbc82d0d90073751f7b49e7b9e9c7e5638", "versionType": "git"}, {"status": "affected", "version": "6.6.64", "lessThan": "6.6.95", "versionType": "semver"}, {"status": "affected", "version": "6.12.2", "lessThan": "6.12.35", "versionType": "semver"}, {"status": "affected", "version": "6.11.11", "lessThan": "6.12", "versionType": "semver"}], "programFiles": ["fs/smb/client/cached_dir.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.95", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.35", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.4", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/cached_dir.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da"}, {"url": "https://git.kernel.org/stable/c/43f26094d6702e494e800532c3f1606e7a68eb30"}, {"url": "https://git.kernel.org/stable/c/4479db143390bdcadc1561292aab579cdfa9f6c6"}, {"url": "https://git.kernel.org/stable/c/a2182743a8b4969481f64aec4908ff162e8a206c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Log an error when close_all_cached_dirs fails\n\nUnder low-memory conditions, close_all_cached_dirs() can't move the\ndentries to a separate list to dput() them once the locks are dropped.\nThis will result in a \"Dentry still in use\" error, so add an error\nmessage that makes it clear this is what happened:\n\n[ 495.281119] CIFS: VFS: \\\\otters.example.com\\share Out of memory while dropping dentries\n[ 495.281595] ------------[ cut here ]------------\n[ 495.281887] BUG: Dentry ffff888115531138{i=78,n=/} still in use (2) [unmount of cifs cifs]\n[ 495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0\n\nAlso, bail out of looping through all tcons as soon as a single\nallocation fails, since we're already in trouble, and kmalloc() attempts\nfor subseqeuent tcons are likely to fail just like the first one did."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.95", "versionStartIncluding": "6.6.64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.35", "versionStartIncluding": "6.12.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.4", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.11.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:08.577Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38321", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:14.275Z", "dateReserved": "2025-04-16T04:51:24.004Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-10T08:14:57.046Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/cached_dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da", "status": "affected", "version": "73934e535cffbda1490fa97d82690a0f9aa73e94", "versionType": "git"}, {"lessThan": "43f26094d6702e494e800532c3f1606e7a68eb30", "status": "affected", "version": "548812afd96982a76a93ba76c0582ea670c40d9e", "versionType": "git"}, {"lessThan": "4479db143390bdcadc1561292aab579cdfa9f6c6", "status": "affected", "version": "3fa640d035e5ae526769615c35cb9ed4be6e3662", "versionType": "git"}, {"lessThan": "a2182743a8b4969481f64aec4908ff162e8a206c", "status": "affected", "version": "3fa640d035e5ae526769615c35cb9ed4be6e3662", "versionType": "git"}, {"status": "affected", "version": "ff4528bbc82d0d90073751f7b49e7b9e9c7e5638", "versionType": "git"}, {"lessThan": "6.6.95", "status": "affected", "version": "6.6.64", "versionType": "semver"}, {"lessThan": "6.12.35", "status": "affected", "version": "6.12.2", "versionType": "semver"}, {"lessThan": "6.12", "status": "affected", "version": "6.11.11", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/cached_dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.95", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.35", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "866FF7CF-AE64-422E-8A7D-4CEF857AA4B7", "versionEndExcluding": "6.6.95", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E569FD34-0076-4428-BE17-EECCF867611C", "versionEndExcluding": "6.12.35", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655", "versionEndExcluding": "6.15.4", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Log an error when close_all_cached_dirs fails\n\nUnder low-memory conditions, close_all_cached_dirs() can't move the\ndentries to a separate list to dput() them once the locks are dropped.\nThis will result in a \"Dentry still in use\" error, so add an error\nmessage that makes it clear this is what happened:\n\n[ 495.281119] CIFS: VFS: \\\\otters.example.com\\share Out of memory while dropping dentries\n[ 495.281595] ------------[ cut here ]------------\n[ 495.281887] BUG: Dentry ffff888115531138{i=78,n=/} still in use (2) [unmount of cifs cifs]\n[ 495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0\n\nAlso, bail out of looping through all tcons as soon as a single\nallocation fails, since we're already in trouble, and kmalloc() attempts\nfor subseqeuent tcons are likely to fail just like the first one did."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: Registra un error cuando close_all_cached_dirs falla. En condiciones de poca memoria, close_all_cached_dirs() no puede mover las entradas a una lista separada para dput() una vez que se eliminan los bloqueos. Esto generar\u00e1 un error \"Dentry a\u00fan en uso\", por lo que debe agregar un mensaje de error que aclare que esto es lo que sucedi\u00f3: [ 495.281119] CIFS: VFS: \\\\otters.example.com\\share Sin memoria al eliminar dentries [ 495.281595] ------------[ cortar aqu\u00ed ]------------ [ 495.281887] ERROR: Dentry ffff888115531138{i=78,n=/} a\u00fan en uso (2) [desmontar cifs cifs] [ 495.282391] ADVERTENCIA: CPU: 1 PID: 2329 en fs/dcache.c:1536 umount_check+0xc8/0xf0 Adem\u00e1s, abandone el bucle a trav\u00e9s de todos los tcons tan pronto como falle una sola asignaci\u00f3n, ya que estamos en problemas y kmalloc() intenta Es probable que las tcons subsiguientes fallen tal como lo hizo la primera."}], "id": "CVE-2025-38321", "lastModified": "2026-10-15T22:18:38.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38321", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:49:37.462417Z", "version": "2.0.3"}}]}, "published": "2025-07-10T09:15:26.103", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/43f26094d6702e494e800532c3f1606e7a68eb30"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4479db143390bdcadc1561292aab579cdfa9f6c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a2182743a8b4969481f64aec4908ff162e8a206c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: smb: Log an error when close_all_cached_dirs fails", "id": "2379231", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379231"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38321", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38321\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38321\nhttps://lore.kernel.org/linux-cve-announce/2025071031-CVE-2025-38321-25aa@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:06:40.797567+00:00", "updated": "2025-07-13T11:06:40.797624+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}