)]}'
{
  "commit": "e2523dd07b96cc75b0940a20895e40e1211f3d29",
  "tree": "692600a0beebaa7e67c58855dfe14067ce3c37ab",
  "parents": [
    "208ef7f49ed3dff9304b348a3593b90758a12799"
  ],
  "author": {
    "name": "Henrique Carvalho",
    "email": "henrique.carvalho@suse.com",
    "time": "Mon Nov 03 19:52:55 2025 -0300"
  },
  "committer": {
    "name": "Angel Adetula",
    "email": "angeladetula@google.com",
    "time": "Fri Dec 12 12:10:49 2025 -0800"
  },
  "message": "smb: client: fix potential UAF in smb2_close_cached_fid()\n\ncommit 734e99623c5b65bf2c03e35978a0b980ebc3c2f8 upstream.\n\nfind_or_create_cached_dir() could grab a new reference after kref_put()\nhad seen the refcount drop to zero but before cfid_list_lock is acquired\nin smb2_close_cached_fid(), leading to use-after-free.\n\nSwitch to kref_put_lock() so cfid_release() is called with\ncfid_list_lock held, closing that gap.\n\nBUG\u003db/467362930\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-40328 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: ebe98f1447bb (\"cifs: enable caching of directories for which a lease is held\")\nCc: stable@vger.kernel.org\nReported-by: Jay Shin \u003cjaeshin@redhat.com\u003e\nReviewed-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.org\u003e\nChange-Id: I18f57a43dc6852cd867e3a6a3f39e2901df6b270\nSigned-off-by: Henrique Carvalho \u003chenrique.carvalho@suse.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/121602\nReviewed-by: Daniel Velasquez \u003crdvelasquez@google.com\u003e\nReviewed-by: Angel Adetula \u003cangeladetula@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d64742ba371aa5424cdc6a166fda70ca46012b5f",
      "old_mode": 33188,
      "old_path": "fs/smb/client/cached_dir.c",
      "new_id": "539a9038fb0dd2791338c2943ed58177ff1367fd",
      "new_mode": 33188,
      "new_path": "fs/smb/client/cached_dir.c"
    }
  ]
}