CVE-2025-37899

ksmbd: fix use-after-free in session logoff

HIGH

7.8

CVSS Score

Published: May 20, 2025 at 03:21 PM UTC

Updated: August 5, 2026 at 12:44 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.9%

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the session being free'd. The handler for that connection could be in the smb2_sess_setup function which makes use of sess->user.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.15 ≤ v < 6.1.1595.15 ≤ v < 6.12.285.15 ≤ v < 6.14.65.15 ≤ v < 6.155.15 ≤ v < 6.6.1196.13 ≤ v < 6.14.66.15 rc1 6.15 rc2 6.15 rc3 6.15 rc4626e6641f6b467447c81dd7678a69c66f7746cf

Vendor states this is fixed in 02d16046cd11a5c037b28c12ffb818c56dd3ef43 (fixed)

Vendor states this is fixed in 2fc9feff45d92a92cd5f96487655d5be23fb7e2b (fixed)

Vendor states this is fixed in 70ad6455139e26e85f48f95d0e21f351c1909342 (fixed)

Vendor states this is fixed in 931dc8a3670f71c45c0b1379ea4e92dafbda1aca (fixed)

Vendor states this is fixed in d5ec1d79509b3ee01de02c236f096bc050221b7f (fixed)

Vendor states this is fixed in 5.15 (unaffected)

Vendor states this is fixed in 6.1.159 (unaffected)

Vendor states this is fixed in 6.12.28 (unaffected)

Vendor states this is fixed in 6.14.6 (unaffected)

Vendor states this is fixed in 6.15 (unaffected)

Vendor states this is fixed in 6.6.119 (unaffected)