7.8

CVE-2025-37899

Exploit

ksmbd: fix use-after-free in session logoff

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in session logoff

The sess->user object can currently be in use by another thread, for
example if another connection has sent a session setup request to
bind to the session being free'd. The handler for that connection could
be in the smb2_sess_setup function which makes use of sess->user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.15 < 6.12.28
Linux ≫ Linux Kernel Version >= 6.13 < 6.14.6
Linux ≫ Linux Kernel Version6.15 Updaterc1
Linux ≫ Linux Kernel Version6.15 Updaterc2
Linux ≫ Linux Kernel Version6.15 Updaterc3
Linux ≫ Linux Kernel Version6.15 Updaterc4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.304
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/d5ec1d79509b3ee01de02c236f096bc050221b7f
Patch
https://git.kernel.org/stable/c/02d16046cd11a5c037b28c12ffb818c56dd3ef43
Patch
https://git.kernel.org/stable/c/2fc9feff45d92a92cd5f96487655d5be23fb7e2b
Patch
https://news.ycombinator.com/item?id=44081338
Third Party Advisory
Exploit
Issue Tracking
https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
Third Party Advisory
Exploit
https://git.kernel.org/stable/c/70ad6455139e26e85f48f95d0e21f351c1909342
https://git.kernel.org/stable/c/931dc8a3670f71c45c0b1379ea4e92dafbda1aca