CVE-2025-37924: Linux Kernel Use-After-Free Vulnerability

CVE-2025-37924 Overview

CVE-2025-37924 is a use-after-free vulnerability in the Linux kernel ksmbd subsystem, specifically in the Kerberos authentication path. The flaw resides in session handling where sess->user is passed to ksmbd_free_user before being set to NULL. Another thread operating on the same session can dereference sess->user during this window, leading to memory corruption. The vulnerability is tracked as [CWE-416] (Use After Free) and affects Linux kernel versions including 6.15 release candidates and Debian Linux 11.

Critical Impact
A local, authenticated attacker can trigger memory corruption in the SMB server kernel module, potentially achieving privilege escalation or kernel-level code execution.

Affected Products

Linux Kernel (multiple stable branches, including 6.15-rc1 through 6.15-rc4)
Debian Linux 11
Any distribution shipping ksmbd with the vulnerable session teardown code

Discovery Timeline

2025-05-20 - CVE-2025-37924 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37924

Vulnerability Analysis

The vulnerability exists in the ksmbd in-kernel SMB3 server, which handles Kerberos authentication for SMB clients. During session teardown or re-authentication, the code calls ksmbd_free_user(sess->user) and then assigns sess->user = NULL to eliminate the dangling pointer. This ordering creates a race window between the free and the nullification. A concurrent thread accessing the same ksmbd_session can read sess->user after the object has been freed but before the pointer is cleared, dereferencing memory that no longer belongs to the session user structure.

Root Cause

The root cause is a lack of synchronization around session user lifetime management. The sess->user pointer is not protected by a lock or reference count during the free-then-null sequence. Any other kernel thread traversing the session structure during authentication processing can operate on the freed ksmbd_user object, satisfying the classic use-after-free pattern described in [CWE-416].

Attack Vector

Exploitation requires a local, authenticated context capable of initiating SMB sessions against a ksmbd server. An attacker triggers concurrent operations on the same session such that one thread frees the user structure while another still holds a reference. Winning the race allows the attacker to force the kernel to access freed memory. Given kernel-level impact on confidentiality, integrity, and availability, successful exploitation can lead to privilege escalation, kernel information disclosure, or system compromise.

No public proof-of-concept exploit is currently available. Technical details are documented across the stable kernel commits that resolve the issue and the Debian LTS Announcement.

Detection Methods for CVE-2025-37924

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ksmbd_free_user, ksmbd_session, or smb2_sess_setup in dmesg or /var/log/kern.log.
KASAN reports flagging use-after-free reads within the ksmbd module on hosts where kernel address sanitizer is enabled.
Abnormal ksmbd.mountd or ksmbd worker thread crashes correlated with SMB session setup activity.

Detection Strategies

Monitor kernel ring buffer output for BUG:, general protection fault, or KASAN entries originating in the ksmbd code path.
Correlate SMB authentication logs with kernel crash telemetry to identify racy session setup patterns from a single client.
Track ksmbd module version against the fixed commits (28c7567, b447463, e18c616, e34a33d, e86e913) to detect vulnerable hosts.

Monitoring Recommendations

Ingest kernel logs into a centralized logging pipeline and alert on ksmbd-tagged faults.
Track SMB session-setup rate per source to flag anomalous concurrency intended to win the race.
Baseline ksmbd service restarts and investigate unexpected restarts after Kerberos authentication events.

How to Mitigate CVE-2025-37924

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that includes the upstream ksmbd fix.
On Debian 11 systems, install the kernel package referenced in the Debian LTS Announcement.
If patching is not immediately possible, disable the ksmbd module on hosts that do not require an in-kernel SMB server.
Restrict SMB access to trusted, authenticated principals only, and place ksmbd hosts behind network segmentation.

Patch Information

The issue is resolved in mainline and stable Linux kernels through the commits 28c7567, b447463, e18c616, e34a33d, and e86e913. The fix reorders session user cleanup and adds synchronization so that sess->user cannot be dereferenced after being freed.

Workarounds

Unload the ksmbd module with modprobe -r ksmbd and blacklist it where SMB serving is unnecessary.
Migrate SMB serving to userspace Samba until the kernel is patched.
Limit exposure of ksmbd TCP port 445 to trusted networks via host firewall rules.

bash

# Blacklist ksmbd until the kernel is patched
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/disable-ksmbd.conf
sudo modprobe -r ksmbd
sudo systemctl disable --now ksmbd.service 2>/dev/null || true

# Verify the running kernel and module status
uname -r
lsmod | grep ksmbd