CVE-2025-22041: Linux Kernel Use-After-Free Vulnerability

CVE-2025-22041 Overview

CVE-2025-22041 is a use-after-free (UAF) vulnerability [CWE-416] in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the ksmbd_sessions_deregister() function and triggers during multichannel SMB operations. When a second channel establishes a session through the connection of the first channel, a session freed via the global session table can be accessed again through the connection's ->sessions list. An authenticated remote attacker who can reach the SMB service can exploit this condition to corrupt kernel memory, causing denial of service or potentially achieving kernel-level code execution.

Critical Impact
A network-adjacent authenticated attacker can trigger memory corruption in the Linux kernel, threatening confidentiality, integrity, and availability of affected hosts running ksmbd.

Affected Products

Linux Kernel (upstream) branches containing the ksmbd server with multichannel support
Debian LTS distributions shipping vulnerable kernel builds (see Debian LTS advisory)
Downstream distributions packaging the affected kernel commits prior to the fix

Discovery Timeline

2025-04-16 - CVE-2025-22041 published to the National Vulnerability Database (NVD)
2025-05 - Debian LTS advisory published referencing the fix
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-22041

Vulnerability Analysis

The ksmbd kernel module implements an SMB3 file server directly in kernel space. SMB3 multichannel allows a single logical session to span multiple TCP connections for throughput and resilience. Each ksmbd_conn object maintains a per-connection ->sessions list, while sessions are also tracked in a global session table.

The vulnerability arises because these two references are not synchronized during session teardown. When one connection deregisters a session and frees it through the global table, another connection that shares the session through multichannel binding retains a dangling pointer in its own ->sessions list. Subsequent operations that iterate this per-connection list dereference freed memory.

Exploitation results in classic UAF primitives: attacker-controlled data can be sprayed into the freed slab object, and the reuse path in ksmbd_sessions_deregister() operates on that memory. The consequences range from kernel panic to arbitrary write, depending on the reallocated object and heap layout.

Root Cause

The root cause is inconsistent lifetime management between the global session table and per-connection session lists in the multichannel setup path. When the second channel binds to an existing session using the first channel's connection, the session is inserted into both structures. Freeing through one path leaves the other reference stale, violating the memory-safety invariants documented in [CWE-416].

Attack Vector

An attacker requires network reachability to the SMB service and low-privilege authentication credentials sufficient to establish an SMB session. The attacker opens an initial SMB3 connection, negotiates a session, then opens a second connection that binds to the same session using SMB3 multichannel. Racing the teardown of one channel against operations on the other triggers the UAF. No user interaction is required.

No verified public proof-of-concept code is available. The upstream fix commits (15a9605f, 33cc29e2, 8ed0e9d2, a8a8ae30, ca042cc0, f0eb3f57) reorder the deregistration logic so the session is removed from all references before being freed. Refer to the Linux Kernel Patch 15a9605 for the canonical fix.

Detection Methods for CVE-2025-22041

Indicators of Compromise

Kernel oops or panic messages referencing ksmbd_sessions_deregister, ksmbd_session_destroy, or KASAN use-after-free reports in dmesg
Unexpected termination of the ksmbd.mountd userspace helper following SMB client disconnects
Multiple concurrent SMB3 connections from a single client rapidly negotiating and tearing down channels against the same session

Detection Strategies

Enable KASAN on test kernels and monitor for use-after-free splats originating in fs/smb/server/
Correlate authentication events from ksmbd with abnormal session churn on port 445
Alert on kernel crash dumps that reference ksmbd symbols using host-based EDR telemetry

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into a centralized log platform and alert on ksmbd error strings
Track SMB3 session bind requests (SMB2_SESSION_SETUP with binding flag) per source address to identify multichannel abuse patterns
Baseline normal SMB client behavior and flag hosts producing atypical rates of channel setup and teardown

How to Mitigate CVE-2025-22041

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry or upgrade to a distribution kernel that includes commits 15a9605f, 33cc29e2, 8ed0e9d2, a8a8ae30, ca042cc0, and f0eb3f57
If patching is not immediately possible, unload the ksmbd module on hosts that do not require it: modprobe -r ksmbd
Restrict inbound TCP/445 access to trusted management networks using host and network firewalls

Patch Information

Upstream fix commits are available on git.kernel.org and are backported across stable branches. Debian users should apply the update described in the Debian LTS Announcement. Other distributions ship the fix through their respective stable kernel updates; verify the running kernel version after reboot with uname -r.

Workarounds

Disable SMB3 multichannel on ksmbd shares by removing server multi channel support = yes from the ksmbd.conf global section and restarting the service
Switch file-serving workloads to Samba (smbd) userspace server until the kernel is patched, since this vulnerability is specific to ksmbd
Enforce network segmentation so that only authenticated, trusted hosts can reach SMB endpoints

bash

# Verify ksmbd is not loaded and block the module from loading
sudo systemctl stop ksmbd.service 2>/dev/null
sudo modprobe -r ksmbd
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Restrict SMB access at the host firewall (example: nftables)
sudo nft add rule inet filter input tcp dport 445 ip saddr != 10.0.0.0/24 drop

# Confirm patched kernel is running
uname -r