CVE-2025-37777

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37777
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is referenced when ksmbd server thread terminates, It will not be freed, but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed asynchronously when the connection is disconnected. __smb2_lease_break_noti calls ksmbd_conn_write, which can cause use-after-free when conn->ksmbd_transport is already freed.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1aec4d14cf81b7b3e7b69eb1cfa94144eed7138e Patch
https://git.kernel.org/stable/c/1da8bd9a10ecd718692732294d15fd801c0eabb5 Patch
https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de Patch
https://git.kernel.org/stable/c/e59796fc80603bcd8569d4d2e10b213c1918edb4 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
History

14 Nov 2025, 16:45

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/1aec4d14cf81b7b3e7b69eb1cfa94144eed7138e - () https://git.kernel.org/stable/c/1aec4d14cf81b7b3e7b69eb1cfa94144eed7138e - Patch
References () https://git.kernel.org/stable/c/1da8bd9a10ecd718692732294d15fd801c0eabb5 - () https://git.kernel.org/stable/c/1da8bd9a10ecd718692732294d15fd801c0eabb5 - Patch
References () https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de - () https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de - Patch
References () https://git.kernel.org/stable/c/e59796fc80603bcd8569d4d2e10b213c1918edb4 - () https://git.kernel.org/stable/c/e59796fc80603bcd8569d4d2e10b213c1918edb4 - Patch

01 Aug 2025, 09:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/1da8bd9a10ecd718692732294d15fd801c0eabb5 -

02 May 2025, 13:53

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: se corrige el error "use-after-free" en __smb2_lease_break_noti(). Se mueve tcp_transport libre a ksmbd_conn_free. Si se hace referencia a la conexión ksmbd al finalizar el subproceso del servidor ksmbd, no se liberará, pero sí se liberará conn->tcp_transport. __smb2_lease_break_noti puede ejecutarse asincrónicamente cuando se desconecta la conexión. __smb2_lease_break_noti llama a ksmbd_conn_write, lo que puede causar un error "use-after-free" cuando conn->ksmbd_transport ya está liberado.

02 May 2025, 07:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/1aec4d14cf81b7b3e7b69eb1cfa94144eed7138e -

01 May 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 14:15

Updated : 2025-11-14 16:45

NVD link : CVE-2025-37777

Mitre link : CVE-2025-37777

CVE.ORG link : CVE-2025-37777

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free