External risk intelligence

Linux Kernel ksmbd Race Condition in File Deletion Logic

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-68809

The vulnerability exists in ksmbd, a Linux kernel SMB server. While SMB services can be exposed to the internet, they are typically deployed in internal, authenticated, or VPN-protected network segments. Public internet exposure is not a standard or recommended deployment practice for SMB file sharing, making reachability possible but not inherently common or intended for public access.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A race condition in the Linux kernel's file sharing component could lead to inconsistent file deletion behavior, potentially causing files to remain on disk after deletion or disappear unexpectedly while in use. This is a critical vulnerability that warrants attention to confirm its relevance to your environment.

A flaw allows files to be handled incorrectly.
Matters if your organization uses Linux file sharing.
Confirm if this Linux kernel issue affects you.

Attack Path

How an attacker could exploit the issue

Attackers could reach this vulnerability by interacting with the Linux kernel's SMB server component. This interaction could involve operations like opening, closing, or deleting files concurrently, potentially leading to inconsistent file deletion behavior.

Requires network access to the SMB server.
Triggered by concurrent file operations.
Results in inconsistent file deletion.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's ksmbd component could affect file deletion semantics for files shared over SMB. When multiple threads concurrently try to open, close, or delete the same file, a race condition on internal file flags may lead to files not being deleted as expected after a delete-on-close operation, or files disappearing unexpectedly while still in use.

File deletion behavior.
Concurrent file operations may cause races.
Inconsistent file state and access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's ksmbd component has a critical race condition vulnerability in its file deletion handling. Infrastructure and platform teams are likely responsible for managing the kernel and its services. The first practical step is to identify all systems running ksmbd, determine if they are reachable from untrusted networks, and assess their business criticality to prioritize remediation.

Infrastructure and platform teams own this.
Verify ksmbd exposure and file system usage.
Plan kernel updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ksmbd component in the Linux kernel?

ksmbd is an in-kernel SMB server that allows a Linux system to share files and printers over a network. It is designed to provide high-performance file sharing capabilities directly within the Linux kernel, enabling Windows-compatible clients to access file resources stored on Linux servers.

How does CVE-2025-68809 create a race condition?

This vulnerability involves a data race where internal flags, used to track if a file should be deleted upon closing, are accessed by multiple threads without consistent locking. This means the system may fail to synchronize concurrent requests to open, close, or delete the same file, resulting in unpredictable file system behavior where files persist when they should have been removed or vanish while still in active use.

When does this vulnerability trigger?

The flaw is triggered when multiple threads perform concurrent operations like opening, closing, or deleting the same file on an SMB share. It does not occur during isolated file access; the race condition specifically arises from the timing conflict between simultaneous requests attempting to update the file's delete-on-close status.

Do I need to worry if my file server is internal?

While Halo Surface Signal notes that SMB services are often deployed within internal, VPN-protected, or authenticated segments, the vulnerability remains relevant to your security posture. Even if not directly on the public internet, any system running ksmbd is a potential target for an attacker who has already gained a foothold within your internal network.

How should I respond to this Linux kernel vulnerability?

Start by identifying all systems in your environment that are running the ksmbd service. Once mapped, assess which of these systems are reachable from untrusted network segments. Prioritize these assets for kernel updates by coordinating with your infrastructure or platform teams to schedule maintenance, ensuring the underlying kernel code is patched to correctly synchronize file deletion flags.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.