CVE-2025-37926
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_session_rpc_open A UAF issue can occur due to a race condition between ksmbd_session_rpc_open() and __session_rpc_close(). Add rpc_lock to the session to protect it.
Analysis
A use-after-free vulnerability exists in the Linux kernel's ksmbd (in-kernel SMB server) component, where a race condition between ksmbd_session_rpc_open() and __session_rpc_close() functions can lead to memory corruption. This vulnerability affects Linux kernel versions up to 6.15-rc4 and allows local attackers with low privileges to potentially execute arbitrary code or cause system crashes, achieving complete compromise of confidentiality, integrity, and availability. With an EPSS score of 0.07%, the vulnerability has low real-world exploitation likelihood despite its high CVSS score, and patches are available from the vendor.
Technical Context
The vulnerability resides in ksmbd, which is the in-kernel SMB/CIFS server implementation in Linux that allows the kernel to serve SMB protocol directly without userspace components. Based on the CPE data, the vulnerability affects Linux kernel versions ranging from earlier releases through 6.15 release candidates (rc1 through rc4). The root cause is a classic use-after-free condition (CWE-416) where memory is accessed after being freed due to improper synchronization between concurrent operations on RPC sessions. The fix involves adding proper locking mechanisms (rpc_lock) to the session structure to prevent the race condition between opening and closing RPC sessions.
Affected Products
The vulnerability affects the Linux kernel from earlier versions through version 6.15 release candidate 4, as indicated by the CPE identifiers cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* with specific mentions of 6.15:rc1 through 6.15:rc4. The ksmbd component, which provides in-kernel SMB server functionality, is specifically impacted. Multiple stable kernel branches have received patches, as evidenced by commits to different kernel trees including stable branches. Users should check their kernel version and whether ksmbd is enabled in their configuration.
Remediation
Apply the available kernel patches by updating to versions containing the fixes: commits 1067361a1cc6ad9cdf7acfc47f90012b72ad1502, 6323fec65fe54b365961fed260dd579191e46121, 8fb3b6c85b7e3127161623586b62abcc366caa20, a1f46c99d9ea411f9bf30025b912d881d36fc709, or a4348710a7267705b75692dc1a000920481d1d92 depending on your kernel branch. For systems that cannot be immediately patched, consider disabling the ksmbd module if SMB server functionality is not required, or restricting local access to trusted users only. Monitor kernel.org and your distribution's security advisories for updated kernel packages containing these fixes.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today