CVE-2025-21967: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21967 Overview

CVE-2025-21967 is a use-after-free vulnerability [CWE-416] in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in ksmbd_free_work_struct, where the ->interim_entry field of a ksmbd_work structure can be accessed after the associated oplock has been freed. An authenticated local attacker with the ability to interact with an SMB share exposed by ksmbd can trigger the freed-object access, potentially leading to memory corruption, privilege escalation, or a kernel crash.

Critical Impact
Successful exploitation can corrupt kernel memory, resulting in denial of service or elevation of privilege to root on systems running an affected ksmbd build.

Affected Products

Linux kernel 6.14-rc1 through 6.14-rc6
Linux kernel builds shipping the vulnerable ksmbd oplock handling code prior to the upstream fixes
Distributions rebasing on the affected 6.14 release candidates

Discovery Timeline

2025-04-01 - CVE-2025-21967 published to the National Vulnerability Database
2026-07-30 - Last updated in the NVD database

Technical Details for CVE-2025-21967

Vulnerability Analysis

The vulnerability lives in the ksmbd kernel module that implements SMB3 file serving in the Linux kernel. ksmbd uses ksmbd_work structures to track in-flight SMB requests, and an ->interim_entry list node links interim oplock break responses to their parent work item.

During oplock break handling, the oplock object owning the interim entry can be freed while the ksmbd_work still holds a reference through its linked list membership. When ksmbd_free_work_struct later dereferences ->interim_entry, it operates on memory that has been released back to the slab allocator. This produces a classic use-after-free condition tracked as [CWE-416].

The upstream maintainers resolved the issue by removing the linked-list bookkeeping entirely. Interim oplock break responses are now sent immediately when a wait is required, eliminating the need to retain interim_entry state that outlives the oplock.

Root Cause

The root cause is a lifetime mismatch between the oplock object and the ksmbd_work structure that references it. The oplock owns the interim_entry list node, but the ksmbd_work cleanup path assumed the entry remained valid. Concurrent oplock teardown could free the memory while the work structure still expected to unlink the node during cleanup.

Attack Vector

Exploitation requires local access with valid SMB credentials to an active ksmbd share. An attacker sends crafted SMB requests that trigger oplock acquisition and interim break flows, then forces the oplock to be freed before the work item completes cleanup. Winning the race causes ksmbd_free_work_struct to touch freed slab memory. Because the attack vector is Local and requires low privileges without user interaction, exploitation is realistic on any multi-user host exposing ksmbd.

The vulnerability manifests in the oplock break workflow inside fs/smb/server/. See the upstream commits referenced in the mitigation section for the exact patched call paths.

Detection Methods for CVE-2025-21967

Indicators of Compromise

Kernel Oops, general protection fault, or KASAN: use-after-free reports referencing ksmbd_free_work_struct or interim_entry in dmesg and journalctl -k output.
Unexpected termination of the ksmbd kernel worker threads, followed by loss of SMB share availability.
Slab corruption warnings such as BUG: KFENCE or slab-use-after-free tied to the ksmbd_work cache.

Detection Strategies

Enable KASAN or KFENCE on test kernels to catch use-after-free access to ksmbd_work->interim_entry before production deployment.
Correlate SMB session activity from unprivileged local users with kernel oops events to identify race-based triggering attempts.
Compare running kernel versions against the fixed commit hashes to identify unpatched hosts across the fleet.

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on ksmbd-tagged panics or memory-safety warnings.
Track loaded kernel modules using lsmod inventory jobs and flag hosts where ksmbd is loaded on kernels 6.14-rc1 through 6.14-rc6.
Baseline SMB client behavior and alert on local users generating anomalous oplock churn against ksmbd shares.

How to Mitigate CVE-2025-21967

Immediate Actions Required

Upgrade to a Linux kernel build that includes the upstream fix commits 62746ae3f541, bb39ed470654, eb51f6f59d19, or fb776765bfc2.
If patching is not immediately feasible, unload the ksmbd module with modprobe -r ksmbd on hosts that do not require SMB serving.
Restrict local user accounts on any system exposing ksmbd and remove SMB access from untrusted principals.

Patch Information

The fix eliminates the interim_entry linked-list tracking and dispatches interim oplock break responses immediately. Apply the fixes from the upstream repository:

Workarounds

Disable and blacklist the ksmbd module on hosts that do not require in-kernel SMB serving, using Samba smbd in userspace instead.
Restrict ksmbd listeners to trusted network segments via host firewall rules to reduce exposure to authenticated local pivots.
Enforce least-privilege SMB share ACLs so that only vetted accounts can trigger oplock-heavy workloads.

bash

# Blacklist ksmbd until the kernel is patched
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
sudo modprobe -r ksmbd
uname -r   # Verify running kernel excludes 6.14-rc1..rc6 or includes the fix commits