GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37899 (GCVE-0-2025-37899)

Vulnerability from cvelistv5 – Published: 2025-05-20 15:21 – Updated: 2026-08-05 11:58
VLAI
Title
ksmbd: fix use-after-free in session logoff
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the session being free'd. The handler for that connection could be in the smb2_sess_setup function which makes use of sess->user.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 931dc8a3670f71c45c0b1379ea4e92dafbda1aca (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 70ad6455139e26e85f48f95d0e21f351c1909342 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < d5ec1d79509b3ee01de02c236f096bc050221b7f (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 02d16046cd11a5c037b28c12ffb818c56dd3ef43 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 2fc9feff45d92a92cd5f96487655d5be23fb7e2b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.119 , ≤ 6.6.* (semver)
Unaffected: 6.12.28 , ≤ 6.12.* (semver)
Unaffected: 6.14.6 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-05-24T19:05:08.356Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/"
          },
          {
            "url": "https://news.ycombinator.com/item?id=44081338"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "931dc8a3670f71c45c0b1379ea4e92dafbda1aca",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "70ad6455139e26e85f48f95d0e21f351c1909342",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "d5ec1d79509b3ee01de02c236f096bc050221b7f",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "02d16046cd11a5c037b28c12ffb818c56dd3ef43",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "2fc9feff45d92a92cd5f96487655d5be23fb7e2b",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.119",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in session logoff\n\nThe sess-\u003euser object can currently be in use by another thread, for\nexample if another connection has sent a session setup request to\nbind to the session being free\u0027d. The handler for that connection could\nbe in the smb2_sess_setup function which makes use of sess-\u003euser."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server; both the freeing SMB2 LOGOFF and the racing SMB2 SESSION_SETUP (multichannel bind) are ordinary SMB PDUs delivered over TCP/445 from a remote client. No local access is required.\nAC:L - The attacker controls both sides of the race \u2014 they open both TCP connections and choose when to send LOGOFF and the binding SESSION_SETUP \u2014 and both paths block on slow ksmbd.mountd IPC round trips (`ksmbd_ipc_login_request()` / `ksmbd_ipc_logout_request()`), giving a very wide window that can be retried indefinitely with fresh sessions.\nPR:L - `smb2_session_logoff()` is gated by `ksmbd_conn_good()` and a successful `ksmbd_session_lookup_all()`, and channel binding requires a non-guest session, so the attacker needs one ordinary unprivileged SMB account (any share user, no admin rights) \u2014 matching the kernel CNA scoring of the sibling multichannel session UAFs CVE-2025-22040/22041.\nUI:N - The attacker drives both connections and both SMB requests entirely on their own; no action by any local user or administrator is needed.\nS:U - The corruption stays within the kernel\u0027s own memory and security authority \u2014 a standard in-kernel use-after-free with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The freed `struct ksmbd_user` holds `name`, `passkey` and `passkey_sz`; after reclaim, `ksmbd_compare_user()` performs a `memcmp` of attacker-chosen length through a dangling pointer (unbounded OOB read usable as an oracle) and `smb2_query_info` FS_OBJECTID copies 16 bytes via `user_passkey(sess-\u003euser)` straight into the network response, disclosing kernel memory and the victim\u0027s NTLM passkey to the remote client.\nI:H - `set_user_flag(sess-\u003euser, KSMBD_USER_FLAG_BAD_PASSWORD)` performs an OR-write into the freed object, and `sess-\u003euser-\u003euid`/`-\u003egid` from freed memory drive `smb_inherit_dacl()` and file ownership; combined with heap spraying of the reclaimed slab object this yields a write primitive suitable for control-flow hijack.\nA:H - Dereferencing the freed `ksmbd_user` (and the `sess-\u003euser = NULL` store racing other readers) reliably produces kernel oopses, slab corruption, or a panic, taking down the file server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:10.107Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/931dc8a3670f71c45c0b1379ea4e92dafbda1aca"
        },
        {
          "url": "https://git.kernel.org/stable/c/70ad6455139e26e85f48f95d0e21f351c1909342"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5ec1d79509b3ee01de02c236f096bc050221b7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/02d16046cd11a5c037b28c12ffb818c56dd3ef43"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fc9feff45d92a92cd5f96487655d5be23fb7e2b"
        }
      ],
      "title": "ksmbd: fix use-after-free in session logoff",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37899",
    "datePublished": "2025-05-20T15:21:34.782Z",
    "dateReserved": "2025-04-16T04:51:23.965Z",
    "dateUpdated": "2026-08-05T11:58:10.107Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37899",
      "date": "2026-09-16",
      "epss": "0.00975",
      "percentile": "0.60353"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37899\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:26.273\",\"lastModified\":\"2026-07-30T06:22:30.547\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix use-after-free in session logoff\\n\\nThe sess-\u003euser object can currently be in use by another thread, for\\nexample if another connection has sent a session setup request to\\nbind to the session being free\u0027d. The handler for that connection could\\nbe in the smb2_sess_setup function which makes use of sess-\u003euser.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: correcci\u00f3n del problema \\\"use-after-free\\\" al cerrar sesi\u00f3n. El objeto sess-\u0026gt;user puede estar siendo utilizado por otro hilo, por ejemplo, si otra conexi\u00f3n ha enviado una solicitud de configuraci\u00f3n de sesi\u00f3n para enlazarse a la sesi\u00f3n que se est\u00e1 liberando. El controlador de esa conexi\u00f3n podr\u00eda estar en la funci\u00f3n smb2_sess_setup, que utiliza sess-\u0026gt;user.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"931dc8a3670f71c45c0b1379ea4e92dafbda1aca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"70ad6455139e26e85f48f95d0e21f351c1909342\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"d5ec1d79509b3ee01de02c236f096bc050221b7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"02d16046cd11a5c037b28c12ffb818c56dd3ef43\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"2fc9feff45d92a92cd5f96487655d5be23fb7e2b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.159\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.119\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.28\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.6\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"6.12.28\",\"matchCriteriaId\":\"A5AE7607-A0C1-4BF7-867C-7743E11A880A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.6\",\"matchCriteriaId\":\"19E5095E-5950-43EA-8E78-FC860855293F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/02d16046cd11a5c037b28c12ffb818c56dd3ef43\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2fc9feff45d92a92cd5f96487655d5be23fb7e2b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70ad6455139e26e85f48f95d0e21f351c1909342\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/931dc8a3670f71c45c0b1379ea4e92dafbda1aca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d5ec1d79509b3ee01de02c236f096bc050221b7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://news.ycombinator.com/item?id=44081338\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:12:11+00:00",
      "cve": "CVE-2025-37899",
      "id": "CVE-2025-37899",
      "initial_release_date": "2025-05-20T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix use-after-free in session logoff",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37899.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T01:57:35Z",
      "cve": "CVE-2025-37899",
      "id": "CVE-2025-37899",
      "initial_release_date": "2025-05-21T00:47:26Z",
      "product_status:known_not_affected": "457",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37899",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37899.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.