CVE-2025-37952

ksmbd: Fix UAF in __close_file_table_ids

published May 20, 2025

CVSS
—
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: Fix UAF in __close_file_table_ids

A use-after-free is possible if one thread destroys the file

via __ksmbd_close_fd while another thread holds a reference to

it. The existing checks on fp->refcount are not sufficient to

prevent this.

The fix takes ft->lock around the section which removes the

file from the file table. This prevents two threads acquiring the

same file pointer via __close_file_table_ids, as well as the other

functions which retrieve a file from the IDR and which already use

this same lock.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00372 · 30.0th percentile
Published
2025-05-20T16:01Z
EPSS history
Timeline
  • 20 MAY 16:01Z
    ksmbd: Fix UAF in __close_file_table_ids
    cvelistv5