Linux CVE-2025-37778

Apply vendor-supplied kernel updates immediately for systems running ksmbd. Upstream fixes available from kernel.org git stable tree: commits 1db2451de23e, 1e440d5b25b7, 6e30c0e10210, d5b554bc8d55, and e83e39a5f6a0 address the issue across different kernel branches (https://git.kernel.org/stable/c/1db2451de23e98bc864c6a6e52aa0d82c91cb325 and related commits). Debian users should upgrade per debian-lts-announce 2025/05/msg00045.html. Ubuntu users should apply security updates from USN-8126-1. For systems where immediate patching is not feasible, disable ksmbd module entirely with 'rmmod ksmbd' and blacklist it in /etc/modprobe.d/ - this prevents all SMB server functionality but eliminates exposure; organizations requiring SMB file sharing should fall back to userspace Samba daemon which is not affected. Alternatively, disable Kerberos authentication in ksmbd configuration (ksmbd.conf) and use NTLM-only authentication as a temporary workaround, though this reduces security posture for legitimate authentication and may not be acceptable in domain environments; this mitigation assumes the vulnerability is specific to the Kerberos code path in krb_authenticate. Monitor for kernel updates from your distribution and prioritize deployment on multi-user systems where local attackers may have existing low-privilege access.