CVE-2025-37776

ksmbd: fix use-after-free in smb_break_all_levII_oplock()

HIGH

CVSS Score

Published: May 1, 2025 at 01:07 PM UTC

Updated: August 5, 2026 at 12:44 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7

Exploit prediction

EPSS 0.4%

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_break_all_levII_oplock() There is a room in smb_break_all_levII_oplock that can cause racy issues when unlocking in the middle of the loop. This patch use read lock to protect whole loop.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.15 ≤ v < 6.12.255.15 ≤ v < 6.14.45.15 ≤ v < 6.155.15 ≤ v < 6.6.886.13 ≤ v < 6.14.46.7 ≤ v < 6.12.256.15 rc1 6.15 rc2626e6641f6b467447c81dd7678a69c66f7746cf

Vendor states this is fixed in 18b4fac5ef17f77fed9417d22210ceafd6525fc7 (fixed)

Vendor states this is fixed in 296cb5457cc6f4a754c4ae29855f8a253d52bcc6 (fixed)

Vendor states this is fixed in d54ab1520d43e95f9b2e22d7a05fc9614192e5a5 (fixed)

Vendor states this is fixed in d73686367ad68534257cd88a36ca3c52cb8b81d8 (fixed)

Vendor states this is fixed in 5.15 (unaffected)

Vendor states this is fixed in 6.12.25 (unaffected)

Vendor states this is fixed in 6.14.4 (unaffected)

Vendor states this is fixed in 6.15 (unaffected)

Vendor states this is fixed in 6.6.88 (unaffected)