CVE-2025-37952

ksmbd: Fix UAF in __close_file_table_ids

HIGH
7.8
CVSS Score
Published: May 20, 2025 at 04:01 PM UTC
Updated: August 5, 2026 at 12:44 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.4%

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix UAF in __close_file_table_ids A use-after-free is possible if one thread destroys the file via __ksmbd_close_fd while another thread holds a reference to it. The existing checks on fp->refcount are not sufficient to prevent this. The fix takes ft->lock around the section which removes the file from the file table. This prevents two threads acquiring the same file pointer via __close_file_table_ids, as well as the other functions which retrieve a file from the IDR and which already use this same lock.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.15 ≤ v < 6.12.295.15 ≤ v < 6.14.75.15 ≤ v < 6.155.15 ≤ v < 6.6.916.13 ≤ v < 6.14.76.7 ≤ v < 6.12.296.15 rc16.15 rc26.15 rc36.15 rc46.15 rc5626e6641f6b467447c81dd7678a69c66f7746cf
Vendor states this is fixed in 16727e442568a46d9cca69fe2595896de86e120d (fixed)
Vendor states this is fixed in 36991c1ccde2d5a521577c448ffe07fcccfe104d (fixed)
Vendor states this is fixed in 9e9841e232b51171ddf3bc4ee517d5d28dc8cad6 (fixed)
Vendor states this is fixed in fec1f9e9a650e8e7011330a085c77e7bf2a08ea9 (fixed)
Vendor states this is fixed in 5.15 (unaffected)
Vendor states this is fixed in 6.12.29 (unaffected)
Vendor states this is fixed in 6.14.7 (unaffected)
Vendor states this is fixed in 6.15 (unaffected)
Vendor states this is fixed in 6.6.91 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/16727e442568a46d9cca69fe2595896de86e120d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/36991c1ccde2d5a521577c448ffe07fcccfe104d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9e9841e232b51171ddf3bc4ee517d5d28dc8cad6
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fec1f9e9a650e8e7011330a085c77e7bf2a08ea9

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card