What is the CVSS score of CVE-2025-38437?

CVE-2025-38437 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2025-38437?

The Linux kernel's ksmbd SMB3 file-sharing server is vulnerable to privilege escalation through an authenticated client connection.. A patch is available.

How to fix or mitigate CVE-2025-38437?

Within 24 hours, identify and document all systems running Linux kernel 6.16-RC series or Debian stable kernels with ksmbd enabled, and assess which systems have SMB file shares exposed to potentially untrusted networks. Within 7 days, apply kernel security updates from Debian LTS or upstream releases; for systems where patching cannot be immediately completed, disable ksmbd or restrict SMB access to known-trusted client systems only. Within 30 days, verify that all production systems have been updated to patched kernels and confirm ksmbd functionality is working properly across all SMB shares.

Linux Kernel CVE-2025-38437

HIGH

Use After Free (CWE-416)

2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Use After Free Memory Corruption Debian Red Hat Debian Linux Suse

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Requires an authenticated SMB session (PR:L) and racing a low-frequency response-pin allocation failure to hit the UAF, so AC:H; local vector with high kernel-memory impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.1 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:20 vuln.today

CVE Published

Jul 25, 2025 - 16:15 nvd

HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix potential use-after-free in oplock/lease break ack

If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's ksmbd in-kernel SMB3 server arises from a use-after-free in the oplock/lease break acknowledgment path, where a failed ksmbd_iov_pin_rsp() response allocation leads to opinfo->state being accessed after free and opinfo_put()/ksmbd_fd_put() being invoked twice. Affected builds include the 6.16 release-candidate series and Debian-packaged stable kernels running ksmbd; an authenticated SMB client interacting with a shared file can trigger the flaw for potential code execution or information disclosure. There is no public exploit identified at time of analysis and EPSS is low (0.15%), but the fix is already merged upstream and shipped via Debian LTS.

Technical ContextAI

ksmbd is the Linux kernel's native in-kernel SMB3 file server (introduced around 5.15), serving as a faster alternative to userspace Samba. The vulnerable code lies in the oplock/lease break acknowledgment handler, where opportunistic locks (oplocks) and leases are cache-coherency mechanisms that let SMB clients cache file data and must be broken/acknowledged when another client requests conflicting access. The root cause is CWE-416 (Use-After-Free): when ksmbd_iov_pin_rsp() fails to allocate/pin the response IOV, the error path still dereferences opinfo->state and calls the reference-releasing routines opinfo_put() and ksmbd_fd_put() a second time, causing double-free/double-put of the opinfo structure and file descriptor. CPE data confirms the affected component is cpe:2.3:o:linux:linux_kernel across multiple versions plus cpe:2.3:o:debian:debian_linux 11.0.

RemediationAI

Patch available per vendor advisory: upgrade to a Linux kernel that includes the ksmbd oplock/lease break fix - the fix is merged upstream and backported across stable branches via the git.kernel.org commits (50f930db2236, 8106adc21a22, 815f1161d6db, 97c355989928, e38ec88a2b42), so apply your distribution's updated kernel package; Debian users should apply the Debian LTS update referenced at https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html. As a compensating control where patching is deferred, disable or unload the ksmbd kernel module (modprobe -r ksmbd) and switch file sharing to userspace Samba, which removes the vulnerable code path entirely at the cost of ksmbd's performance benefits. If ksmbd must remain enabled, restrict SMB access to trusted authenticated users and network-segment/firewall the SMB ports (TCP 445) to limit which principals can open shares and race the oplock break path, accepting that this narrows but does not eliminate the exposure since any authenticated user can still attempt the trigger.

More in Debian Linux

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2019-11043 CRITICAL Emergency POC

9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL Act Now POC

9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2014-6271 CRITICAL Act Now POC

9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2017-7494 CRITICAL Act Now POC

9.8 May 30

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2025-49113 CRITICAL Act Now POC

9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2022-30333 HIGH Act Now POC

7.5 May 09

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o

CVE-2016-3714 HIGH Act Now POC

8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.

CVE-2017-12617 HIGH Act Now POC

8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT

CVE-2020-1938 CRITICAL Act Now POC

9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate

CVE-2018-7602 CRITICAL Act Now POC

9.8 Jul 19

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2025-38437 vulnerability details – vuln.today

Back

Linux Kernel CVE-2025-38437

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Debian Linux

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code