CVE-2025-37924

ksmbd: fix use-after-free in kerberos authentication

State: Published
Severity: 9.8 Critical
Published: May 20, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in kerberos authentication

Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0626e6641f6b467447c81dd7678a69c66f7746cf to before e34a33d5d7e87399af0a138bb32f6a3e95dd83d2Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before b447463562238428503cfba1c913261047772f90Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before e18c616718018dfc440e4a2d2b94e28fe91b1861Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 28c756738af44a404a91b77830d017bb0c525890Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before e86e9134e1d1c90a960dd57f59ce574d27b9a124Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.138 through 6.1.Not affected 6.6.90 through 6.6.Not affected 6.12.28 through 6.12.Not affected 6.14.6 through 6.14.Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

0626e6641f6b467447c81dd7678a69c66f7746cf to before e34a33d5d7e87399af0a138bb32f6a3e95dd83d2Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before b447463562238428503cfba1c913261047772f90Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before e18c616718018dfc440e4a2d2b94e28fe91b1861Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 28c756738af44a404a91b77830d017bb0c525890Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before e86e9134e1d1c90a960dd57f59ce574d27b9a124Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.138 through 6.1.*Not affected
6.6.90 through 6.6.*Not affected
6.12.28 through 6.12.*Not affected
6.14.6 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.