CVE-2025-39819

{"id": "CVE-2025-39819", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39819", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:12:09.908513Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a7d5c294628088781da9e91cbb034d61c3a71f71", "lessThan": "3fc11ff13fbc2749871d6ac2141685cf54699997", "versionType": "git"}, {"status": "affected", "version": "a7d5c294628088781da9e91cbb034d61c3a71f71", "lessThan": "4191ea1f0bb3e27d65c5dcde7bd00e709ec67141", "versionType": "git"}, {"status": "affected", "version": "a7d5c294628088781da9e91cbb034d61c3a71f71", "lessThan": "4735f5991f51468b85affb8366b7067248457a71", "versionType": "git"}, {"status": "affected", "version": "a7d5c294628088781da9e91cbb034d61c3a71f71", "lessThan": "cc82c6dff548f0066a51a6e577c7454e7d26a968", "versionType": "git"}, {"status": "affected", "version": "a7d5c294628088781da9e91cbb034d61c3a71f71", "lessThan": "ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e", "versionType": "git"}], "programFiles": ["fs/smb/client/smb2inode.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.150", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.104", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.45", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.5", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/smb2inode.c"], "defaultStatus": "affected"}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-09-16T13:15:58.260", "references": [{"url": "https://git.kernel.org/stable/c/3fc11ff13fbc2749871d6ac2141685cf54699997", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4191ea1f0bb3e27d65c5dcde7bd00e709ec67141", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4735f5991f51468b85affb8366b7067248457a71", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cc82c6dff548f0066a51a6e577c7454e7d26a968", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/smb: Fix inconsistent refcnt update\n\nA possible inconsistent update of refcount was identified in `smb2_compound_op`.\nSuch inconsistent update could lead to possible resource leaks.\n\nWhy it is a possible bug:\n1. In the comment section of the function, it clearly states that the\nreference to `cfile` should be dropped after calling this function.\n2. Every control flow path would check and drop the reference to\n`cfile`, except the patched one.\n3. Existing callers would not handle refcount update of `cfile` if\n-ENOMEM is returned.\n\nTo fix the bug, an extra goto label \"out\" is added, to make sure that the\ncleanup logic would always be respected. As the problem is caused by the\nallocation failure of `vars`, the cleanup logic between label \"finished\"\nand \"out\" can be safely ignored. According to the definition of function\n`is_replayable_error`, the error code of \"-ENOMEM\" is not recoverable.\nTherefore, the replay logic also gets ignored."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs/smb: Correcci\u00f3n de actualizaci\u00f3n inconsistente de refcnt\n\nSe identific\u00f3 una posible actualizaci\u00f3n inconsistente de refcount en 'smb2_compound_op'.\nDicha actualizaci\u00f3n inconsistente podr\u00eda llevar a posibles fugas de recursos.\n\nPor qu\u00e9 es un posible error:\n1. En la secci\u00f3n de comentarios de la funci\u00f3n, se indica claramente que la referencia a 'cfile' deber\u00eda liberarse despu\u00e9s de llamar a esta funci\u00f3n.\n2. Cada ruta de flujo de control verificar\u00eda y liberar\u00eda la referencia a 'cfile', excepto la parcheada.\n3. Los llamadores existentes no manejar\u00edan la actualizaci\u00f3n de refcount de 'cfile' si se devuelve -ENOMEM.\n\nPara corregir el error, se a\u00f1ade una etiqueta 'goto' adicional 'out', para asegurar que la l\u00f3gica de limpieza siempre se respetar\u00eda. Como el problema es causado por el fallo de asignaci\u00f3n de 'vars', la l\u00f3gica de limpieza entre la etiqueta 'finished' y 'out' puede ignorarse de forma segura. Seg\u00fan la definici\u00f3n de la funci\u00f3n 'is_replayable_error', el c\u00f3digo de error '-ENOMEM' no es recuperable. Por lo tanto, la l\u00f3gica de reintento tambi\u00e9n se ignora."}], "lastModified": "2026-11-05T22:17:32.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCCDFAD5-09C3-4191-ADDA-361FB84C7B93", "versionEndExcluding": "6.1.150", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD12E3C3-F737-4936-9A57-80832E36D22F", "versionEndExcluding": "6.6.104", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC443D7D-A411-41FB-BB45-010F36EF7C94", "versionEndExcluding": "6.12.45", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB781080-7001-4FA1-B388-517FFEFBC73E", "versionEndExcluding": "6.16.5", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}