CVE-2025-68263
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock. Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event(): BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd] Write of size 12 at addr ffff888198ee6e20 by task pool/109349 ... Freed by task: kvfree ipc_msg_send_request [ksmbd] ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd] Fix by: - Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table. - Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock. - Returning NULL in the error path, preserving the original API semantics. This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.
Analysis
Use-after-free in Linux ksmbd IPC handler allows remote unauthenticated attackers to trigger memory corruption via race condition in generic netlink reply processing. The flaw (CVSS 9.8 critical, network-reachable) affects ksmbd's ipc_msg_send_request() function where concurrent access to response buffers occurs without proper locking. EPSS data not provided; no CISA KEV listing identified at time of analysis. Multiple upstream kernel commits available across stable branches indicate vendor-released patches exist.
Technical Context
This vulnerability resides in ksmbd, the Linux kernel's in-kernel SMB3 server implementation introduced in kernel 5.15. The flaw occurs in the inter-process communication (IPC) layer that uses generic netlink sockets for communication between kernel and userspace components. Specifically, ipc_msg_send_request() allocates an ipc_msg_table_entry structure on the stack and waits for replies from generic netlink handlers. The race condition emerges because handle_response() writes to entry->response while holding ipc_msg_table_lock, but ipc_msg_send_request() validated and freed entry->response without acquiring the same lock. Under high concurrency (multiple SMB sessions/RPC operations), this creates a classic time-of-check-time-of-use window where one thread frees memory that another thread is actively writing to, triggering KASAN slab-use-after-free detection. The root cause is inadequate synchronization in concurrent memory management, representing a CWE-416 class vulnerability (Use After Free) though no CWE was formally assigned.
Affected Products
Linux kernel versions running the ksmbd module are affected, specifically stable kernel branches as evidenced by commits to multiple stable trees (commit hashes 1fab1fa091f5, 5ac763713a1e, 708a620b471a, 759c8c30cfa8, 8229c6ca50ce, de85fb58f996 across different branches). The ksmbd feature was introduced in Linux 5.15 and is present in subsequent mainline and long-term support kernels. Exact vulnerable version ranges are not explicitly provided in available data, but the presence of patches across multiple stable branches suggests the vulnerability existed in ksmbd since its introduction and affects 5.15+ kernels prior to patched versions. Only systems with ksmbd enabled and actively serving SMB traffic are exploitable. Vendor advisories available at the provided kernel.org git stable references.
Remediation
Update to patched Linux kernel versions containing the fixes referenced in commits 1fab1fa091f5aa97265648b53ea031deedd26235, 5ac763713a1ef8f9a8bda1dbd81f0318d67baa4e, 708a620b471a14466f1f52c90bf3f65ebdb31460, 759c8c30cfa8706c518e56f67971b1f0932f4b9b, 8229c6ca50cea701e25a7ee25f48441b582ec5fa, or de85fb58f9967ba024bb08e0041613d37b57b4d1 available at https://git.kernel.org/stable/. Consult your Linux distribution's security advisories for specific patched kernel package versions (e.g., Ubuntu, RHEL, SUSE kernels incorporate upstream stable fixes with distribution-specific versioning). As an immediate risk-reduction measure, systems not requiring in-kernel SMB server functionality should disable ksmbd module loading via kernel command line or module blacklisting. Organizations using SMB file sharing can migrate to userspace Samba as a workaround, which is unaffected by this kernel-specific vulnerability. Monitor distribution security channels for backported fixes to deployed kernel versions.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today