CVE-2025-68817

ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency

State: Published
Severity: 9.8 Critical
Published: Jan 13, 2026
Updated: Aug 5, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency

Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	dd45db4d9bbc8f122a9b4db5ce94ae29fcf03d3c to before 446beed646b2e426dd53d27358365f8678e1dd01Affected 7b58ee8d0b91359554cf219cd4f33872ea2afd66 to before d092de8a26c952379ded8e6b0bda31d89befac1aAffected 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e to before d64977495e44855f2b28d8ce56107c963a7a50e4Affected 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e to before 21a3d01fc6db5129f81edb0ab7cb94fd758bcbeaAffected 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e to before 063cbbc6f595ea36ad146e1b7d2af820894beb21Affected 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e to before b39a1833cc4a2755b02603eec3a71a85e9dff926Affected 5.15.145 to before 5.15.199Affected 6.1.71 to before 6.1.160Affected
LinuxLinux	6.6Affected before 6.6Not affected 5.15.199 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.3 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

dd45db4d9bbc8f122a9b4db5ce94ae29fcf03d3c to before 446beed646b2e426dd53d27358365f8678e1dd01Affected
7b58ee8d0b91359554cf219cd4f33872ea2afd66 to before d092de8a26c952379ded8e6b0bda31d89befac1aAffected
33b235a6e6ebe0f05f3586a71e8d281d00f71e2e to before d64977495e44855f2b28d8ce56107c963a7a50e4Affected
33b235a6e6ebe0f05f3586a71e8d281d00f71e2e to before 21a3d01fc6db5129f81edb0ab7cb94fd758bcbeaAffected
33b235a6e6ebe0f05f3586a71e8d281d00f71e2e to before 063cbbc6f595ea36ad146e1b7d2af820894beb21Affected
33b235a6e6ebe0f05f3586a71e8d281d00f71e2e to before b39a1833cc4a2755b02603eec3a71a85e9dff926Affected
5.15.145 to before 5.15.199Affected
6.1.71 to before 6.1.160Affected

LinuxLinux

6.6Affected
before 6.6Not affected
5.15.199 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.3 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.