CVE-2025-21967

ksmbd: fix use-after-free in ksmbd_free_work_struct

State: Published
Severity: 8.8 High
Published: Apr 1, 2025
Updated: Oct 30, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in ksmbd_free_work_struct

->interim_entry of ksmbd_work could be deleted after oplock is freed. We don't need to manage it with linked list. The interim request could be immediately sent whenever a oplock break wait is needed.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	0626e6641f6b467447c81dd7678a69c66f7746cf to before ffe0909010b21df8f948d624ad00cf14dd856721Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 62746ae3f5414244a96293e3b017be637b641280Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before eb51f6f59d19b92f6fe84d3873f958495ab32f0aAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before bb39ed47065455604729404729d9116868638d31Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.84 through 6.6.Not affected 6.12.20 through 6.12.Not affected 6.13.8 through 6.13.Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

0626e6641f6b467447c81dd7678a69c66f7746cf to before ffe0909010b21df8f948d624ad00cf14dd856721Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 62746ae3f5414244a96293e3b017be637b641280Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before eb51f6f59d19b92f6fe84d3873f958495ab32f0aAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before bb39ed47065455604729404729d9116868638d31Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.84 through 6.6.*Not affected
6.12.20 through 6.12.*Not affected
6.13.8 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.