CVE-2025-37924
Published: May 20, 2025
Modified: May 11, 2026
CVSS v3.1
9.8
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL.
| Vendor | Product | Versions |
|---|---|---|
Linux | Linux | affected 0626e6641f6b467447c81dd7678a69c66f7746cf - < e34a33d5d7e87399af0a138bb32f6a3e95dd83d2affected 0626e6641f6b467447c81dd7678a69c66f7746cf - < b447463562238428503cfba1c913261047772f90affected 0626e6641f6b467447c81dd7678a69c66f7746cf - < e18c616718018dfc440e4a2d2b94e28fe91b1861affected 0626e6641f6b467447c81dd7678a69c66f7746cf - < 28c756738af44a404a91b77830d017bb0c525890affected 0626e6641f6b467447c81dd7678a69c66f7746cf - < e86e9134e1d1c90a960dd57f59ce574d27b9a124 |
Linux | Linux | affected 5.15unaffected 0 - < 5.15unaffected 6.1.138 - <= 6.1.*unaffected 6.6.90 - <= 6.6.*unaffected 6.12.28 - <= 6.12.*+2 more versions |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now