Linux Kernel ksmbd CVE-2025-68809

Exploitation requires that the target run the in-kernel ksmbd SMB server (CONFIG_SMB_SERVER) and actively export at least one share, with the attacker able to open, close, and delete the same file concurrently over SMB - i.e., it depends on the ksmbd deployment mode being enabled, which is NOT the default on most Linux distributions (Samba is the common SMB server). What limits exploitation: the flaw is a data race, so the attacker must repeatedly win a tight kernel timing window through parallel operations on one inode; effective abuse needs share access with delete/write rights (guest or authenticated), and impact is confined to delete-consistency (integrity/availability) with no confidentiality disclosure per the CVSS vector. Absence of ksmbd, or read-only/no-delete share permissions, prevents the race from being triggered.

Signals conflict, so this warrants scrutiny rather than automatic prioritization. The published CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H), which treats this as remotely reachable and unauthenticated with high integrity and availability impact - consistent with a network SMB server whose data-consistency (delete) semantics can be corrupted. However, the mechanism is a data race that requires winning a tight timing window through concurrent open/close/delete of the same file, which in practice is far from AC:L; a more honest attack complexity is high, and realistic exploitation needs at least share access, so PR:N is optimistic. EPSS is 0.03% (7th percentile), there is no CISA KEV listing and no public exploit identified, and there is no SSVC record in the input - all pointing to low real-world exploitation pressure. The 'Information Disclosure' tag conflicts with the CVSS vector (C:N, meaning no confidentiality impact); treat the tag as unreliable and defer to the vector, which describes an integrity/availability (delete-semantics) issue, not data leakage. Net: a legitimately patch-worthy correctness bug, but the 9.1 headline overstates urgency for most environments given the timing dependency and absence of exploitation evidence.

An attacker with access to a ksmbd-served share opens the same file from multiple concurrent SMB sessions and repeatedly sets delete-on-close while racing close and delete operations to hit the unlocked m_flags update window. Winning the race corrupts the pending-delete/delete-on-close bits, causing files to remain on disk after they should be deleted or to be unlinked while other clients still hold them open, undermining data integrity and availability. No public exploit code is known, and success depends on repeatedly winning a narrow kernel timing window.