CVE-2025-37924

CVE-2025-37924 is a race-condition use-after-free (CWE-416) in the Linux kernel's ksmbd in-kernel SMB3 server, in its Kerberos authentication path. The kernel had set sess->user to NULL only after calling ksmbd_free_user to cure a dangling-pointer bug, but a concurrent thread operating on the same session can still read sess->user in the window between the free and the NULL assignment, dereferencing freed memory. Per the CVSS 3.1 vector (AV:L/PR:L, 7.8 High with C:H/I:H/A:H), a low-privileged local attacker can reach the flaw without user interaction and could gain the typical outcomes of a kernel use-after-free — local privilege escalation, information disclosure, or a crash. Any Linux system running a kernel with the ksmbd SMB server and Kerberos-authenticated SMB sessions is affected, including Debian Linux kernels per the advisory data. There is no known public proof-of-concept and the flaw is not in CISA KEV, but EPSS assigns a 20.7% (~97th percentile) probability of exploitation within 30 days.

What to do: Apply a kernel update from your distribution (e.g., Debian security updates or stable-series kernel releases) that includes the ksmbd use-after-free fix. As an interim mitigation, stop/disable the ksmbd SMB server (do not load the ksmbd module) or restrict Kerberos-authenticated SMB sessions on affected hosts. Check whether the ksmbd module is loaded and an SMB server is running before prioritizing.