Vulnary
← back to the feed
Critical· 9.1official fix available

CVE-2025-68809

A race condition in the Linux kernel's ksmbd component allows inconsistent handling of file deletion states (m_flags) when multiple threads access files concurrently. This could lead to files remaining on disk after deletion or disappearing while in use. The vulnerability has been resolved by adding proper locking around m_flags accesses.

publishedJan 13, 2026
last modifiedJul 30, 2026
sourcesNVD
severity · cvss
9.1
critical · how bad it is
exploitation · epss
<1%
36th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 29, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Systems using the Linux kernel's ksmbd component (specific products not listed)

02

Real-world impact

Potential data loss or confusion in file deletion operations under concurrent access

03

Why this severity

Critical (CVSS 9.1): High risk of data inconsistency leading to file system corruption or loss

04

What to do about it

official fix available
recommended steps
  1. 01Apply the Linux kernel patch that adds ci->m_lock protection to all functions accessing m_flags (ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(), ksmbd_clear_inode_pending_delete(), ksmbd_fd_set_delete_on_close())
  2. 02Ensure ksmbd_query_inode_status() checks m_flags under ci->m_lock after dropping inode_hash_lock
  3. 03Verify existing __ksmbd_inode_close() logic remains protected by ci->m_lock while moving unlink/xattr removal outside the lock

NVD description of the resolved vulnerability

05

Timeline

  1. Jan 13, 2026 · Jan 13, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 30, 2026 · 6d ago
    Advisory updated
    The NVD record was last revised.
  3. Jul 30, 2026 · 6d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactNone
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →