Riskcovery

CVE-2025-38437

ksmbd: fix potential use-after-free in oplock/lease break ack

State
Published
Severity
8.8 High
Published
Jul 25, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix potential use-after-free in oplock/lease break ack

If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before e38ec88a2b42c494601b1213816d75f0b54d9bf0Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 97c355989928a5f60b228ef5266c1be67a46cdf9Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 815f1161d6dbc4c54ccf94b7d3fdeab34b4d7477Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 8106adc21a2270c16abf69cd74ccd7c79c6e7acdAffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 50f930db22365738d9387c974416f38a06e8057eAffected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 6.1.146 through 6.1.*Not affected
  • 6.6.99 through 6.6.*Not affected
  • 6.12.39 through 6.12.*Not affected
  • 6.15.7 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.