CVE-2025-38561: Linux Kernel Race Condition Vulnerability

CVE-2025-38561 Overview

CVE-2025-38561 is a race condition vulnerability in the Linux kernel's ksmbd (Kernel SMB Direct) component. The vulnerability exists in the handling of Preauth_HashValue during SMB session setup operations. When a client sends multiple session setup requests simultaneously to ksmbd, a race condition can occur in the Preauth_HashValue processing logic, potentially leading to memory corruption and system instability.

Critical Impact
This race condition vulnerability can be exploited locally to cause a denial of service condition, potentially crashing the kernel or causing system instability on systems running the ksmbd SMB server.

Affected Products

Linux Kernel (multiple versions)
Debian Linux 11.0

Discovery Timeline

2025-08-19 - CVE-2025-38561 published to NVD
2026-01-07 - Last updated in NVD database

Technical Details for CVE-2025-38561

Vulnerability Analysis

This vulnerability is classified as CWE-362 (Race Condition), specifically affecting the session authentication mechanism in the ksmbd kernel module. The ksmbd component implements the SMB3 protocol directly in the Linux kernel for high-performance file sharing. During the session setup phase, the Preauth_HashValue structure is used to maintain cryptographic state for pre-authentication integrity verification.

The flaw occurs because the code prematurely frees sess->Preauth_HashValue during the session setup phase while other concurrent operations may still be accessing the same memory. When multiple session setup requests are processed simultaneously, one thread may free the hash value while another thread is still reading or writing to it, creating a classic use-after-free scenario through race condition.

The vulnerability requires local access and has high attack complexity due to the precise timing needed to trigger the race condition. Successful exploitation results in a denial of service through kernel memory corruption or crash, though no confidentiality or integrity impacts are expected based on the attack surface.

Root Cause

The root cause is improper memory management in the session setup handler. The Preauth_HashValue memory was being freed during the session setup phase, when multiple concurrent requests could still reference this memory. The fix defers the deallocation of sess->Preauth_HashValue to the connection termination phase, where it can be safely freed along with the rest of the session data, ensuring no concurrent access is possible.

Attack Vector

The attack requires local access to a system running the ksmbd kernel module. An attacker would need to:

Have local access to a system with ksmbd enabled and configured
Send multiple concurrent SMB session setup requests
Time the requests to trigger the race condition where one thread frees the Preauth_HashValue while another is still accessing it

The vulnerability is triggered through the SMB3 session establishment process, where the pre-authentication integrity hash is calculated and stored. The race window exists between the point where the hash value is being processed and when it might be freed by a concurrent operation.

Detection Methods for CVE-2025-38561

Indicators of Compromise

Kernel panic or oops messages related to ksmbd module operations
Unexpected crashes in systems running SMB file sharing services
Memory corruption warnings in kernel logs referencing ksmbd session handling
Abnormal number of SMB session setup requests in network logs

Detection Strategies

Monitor kernel logs for ksmbd-related crash reports or memory access violations
Implement system monitoring to detect unusual patterns of SMB session establishment requests
Use kernel debugging tools to track memory allocation and deallocation patterns in the ksmbd module
Deploy network monitoring to identify rapid successive SMB session setup attempts from local sources

Monitoring Recommendations

Enable kernel crash dump analysis for forensic investigation of any ksmbd-related incidents
Configure alerting on kernel oops or panic events involving the ksmbd module
Monitor system stability metrics on servers running ksmbd file sharing services
Review SMB access logs for unusual session establishment patterns

How to Mitigate CVE-2025-38561

Immediate Actions Required

Apply the latest kernel patches that address this vulnerability
Consider temporarily disabling ksmbd if not actively required while patches are applied
Restrict local access to systems running ksmbd to trusted users only
Implement network segmentation to limit exposure of SMB services

Patch Information

Multiple patches have been released to address this vulnerability across different kernel versions. The fix modifies the memory management approach for Preauth_HashValue, ensuring it is only freed during connection termination rather than during session setup. The following kernel patches are available:

Additional information is available from the Zero Day Initiative Advisory ZDI-25-916 and Debian LTS Security Announcement.

Workarounds

If ksmbd is not required, disable the ksmbd kernel module: rmmod ksmbd or blacklist it in /etc/modprobe.d/
Use Samba userspace implementation instead of ksmbd for SMB file sharing if kernel-based SMB is not essential
Implement strict access controls to limit which users can initiate SMB connections
Consider using firewall rules to rate-limit SMB session establishment requests

bash

# Disable ksmbd module if not needed
sudo rmmod ksmbd

# Blacklist ksmbd to prevent automatic loading
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/ksmbd-blacklist.conf

# Check kernel version and update if necessary
uname -r
sudo apt update && sudo apt upgrade linux-image-$(uname -r)