In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if anoth…
High CVSS 8.8
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the session being free'd. The handler for that connection could be in the smb2_sess_setup function which makes use of sess->user.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Lint boundary warnings (2)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://news.ycombinator.com/item?id=44081338 -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/02d16046cd11a5c037b28c12ffb818c56dd3ef43 Patch
- https://git.kernel.org/stable/c/2fc9feff45d92a92cd5f96487655d5be23fb7e2b Patch
- https://git.kernel.org/stable/c/70ad6455139e26e85f48f95d0e21f351c1909342
- https://git.kernel.org/stable/c/931dc8a3670f71c45c0b1379ea4e92dafbda1aca
- https://git.kernel.org/stable/c/d5ec1d79509b3ee01de02c236f096bc050221b7f Patch
- https://news.ycombinator.com/item?id=44081338 Exploit
- https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/ Exploit
Timeline
- nvd_ingest NVD