CVE-2025-22040: Linux Kernel Use-After-Free Vulnerability

CVE-2025-22040 Overview

CVE-2025-22040 is a use-after-free vulnerability [CWE-416] in the Linux kernel's ksmbd in-kernel Server Message Block (SMB) server. The flaw resides in the multichannel connection handling path, where a race condition exists between session setup and ksmbd_sessions_deregister. An authenticated SMB client can trigger a window in which the session structure is freed before a new connection is added to the session's channel list, leading to access of freed memory. The upstream fix adds a reference count check on the session before deallocation.

Critical Impact
An authenticated remote attacker on the network can exploit a race in ksmbd multichannel setup to trigger a kernel-space use-after-free, enabling potential memory corruption, kernel information disclosure, or code execution.

Affected Products

Linux Kernel (multiple stable branches containing ksmbd with multichannel support)
Debian Linux 11 (per Debian LTS advisory)
Any distribution shipping kernels with ksmbd enabled prior to the referenced stable commits

Discovery Timeline

2025-04-16 - CVE-2025-22040 published to the National Vulnerability Database (NVD)
2025-05 - Debian LTS security announcement published for affected kernel packages
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22040

Vulnerability Analysis

The ksmbd module implements an in-kernel SMB3 server for Linux. SMB3 supports multichannel connections, which allow a single logical session to span multiple TCP connections for throughput and resilience. When a client initiates additional channels, ksmbd performs a session setup exchange and then attaches the new connection to the session's channel list.

A race condition exists between this session setup path and ksmbd_sessions_deregister, which tears down sessions when a connection is dropped. The deregister path can free the ksmbd_session object while the parallel session setup path still holds a reference to it and is about to insert the new channel into the session's list. Once the object is freed, the subsequent channel insertion operates on freed memory, producing a classic use-after-free condition in kernel space. Depending on allocator state and memory reuse, this can result in kernel panic, corruption of adjacent slab objects, or controlled overwrite primitives useful for privilege escalation.

Root Cause

The underlying defect is missing reference-count validation in the session teardown path. ksmbd_sessions_deregister did not verify that no other in-flight operation was still using the session before freeing it. The upstream patch series adds a reference count check so that the session is only freed after all channel setup paths have released their reference. Relevant fixes are in commits 3980770, 596407a, 7dfbd4c, 9069939, 94c2817, and fa4cdb8 in the stable tree.

Attack Vector

Exploitation requires network access to an SMB service exposed by ksmbd and valid credentials to reach the session setup stage. The attacker opens an initial SMB connection, authenticates, and then races additional multichannel binding requests against a connection teardown. Because the race window is entirely within the kernel SMB state machine, no user interaction on the server is required. See the Linux Kernel Commit 3980770 and the Debian LTS Announcement for authoritative technical detail.

Detection Methods for CVE-2025-22040

Indicators of Compromise

Kernel messages referencing ksmbd, slab corruption, general protection fault, or KASAN: use-after-free in ksmbd_sessions_deregister or session setup handlers.
Unexpected ksmbd.mountd or kernel worker crashes on hosts exposing SMB via ksmbd.
Repeated short-lived SMB3 multichannel bind requests from a single client immediately followed by TCP resets.

Detection Strategies

Enable kernel address sanitizer (KASAN) on test kernels to surface use-after-free reports in fs/smb/server/ code paths.
Alert on dmesg or /var/log/kern.log entries containing ksmbd, BUG:, Oops, or Call Trace patterns.
Monitor SMB session establishment volume per source and flag anomalous bursts of session setup followed by disconnect events targeting multichannel-capable servers.

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and search for ksmbd fault traces.
Track running kernel version against distribution advisories and flag hosts still on vulnerable builds where ksmbd is loaded (lsmod | grep ksmbd).
Baseline SMB traffic to ksmbd hosts and alert on unauthenticated scanners probing port 445.

How to Mitigate CVE-2025-22040

Immediate Actions Required

Apply the latest stable kernel updates from your distribution that include the ksmbd reference-count fix.
If patching is not immediately feasible, unload the ksmbd module (modprobe -r ksmbd) on hosts where it is not required.
Restrict SMB access at the network layer to trusted management networks and authenticated users only.
Audit which Linux hosts expose ksmbd rather than Samba (smbd), as only the in-kernel implementation is affected.

Patch Information

The issue is resolved by the upstream commits 3980770cb147, 596407adb9af, 7dfbd4c43eed, 9069939d7621, 94c281721d4e, and fa4cdb8cbca7, backported across multiple stable branches. Debian users should update per the Debian LTS Announcement. Verify by comparing the running kernel version against the fixed versions listed by your distribution vendor.

Workarounds

Disable ksmbd and use user-space Samba (smbd) as an alternative SMB server where feasible.
Block inbound TCP port 445 at the perimeter and internal segmentation firewalls for hosts that do not need to serve SMB.
Enforce strong authentication on SMB shares to raise the bar for reaching the vulnerable session-setup code path.

bash

# Configuration example: unload ksmbd and prevent it from loading at boot
sudo systemctl stop ksmbd.service 2>/dev/null || true
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
sudo update-initramfs -u

# Verify the module is no longer loaded
lsmod | grep ksmbd || echo "ksmbd not loaded"

# After patching, confirm the running kernel version matches the fixed release
uname -r