Critical Warning in Linux Kernel: Blocking Operations in ksmbd Package
Summary
CVE-2025-37802: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" wait_event_timeout() will set the state of the current task to TASK_UNINTERRUPTIBLE, be... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing hardware and system resources. It provides essential services for all other parts of the system. The ksmbd package is a kernel-based implementation of the SMB protocol, allowing file sharing and printing services over a network. This vulnerability affects the ksmbd package, which is crucial for enabling seamless file access across different operating systems.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ksmbd package where the function wait_event_timeout() sets the current task's state to TASK_UNINTERRUPTIBLE before checking the condition. This leads to the ksmbd_durable_scavenger_alive() function attempting to acquire a mutex while in a sleeping state, triggering a warning from the scheduler. The warning indicates that blocking operations should not be called when the task is not running, which can lead to potential deadlocks or system instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-37802 vulnerability in the Linux kernel's ksmbd package poses a significant risk by allowing blocking operations to be called in an inappropriate task state. It is essential to update your Linux package to the latest version to mitigate this risk and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37802 is a vulnerability in the Linux kernel's ksmbd package that can lead to warnings about blocking operations being called when the task is not running.
This vulnerability can potentially lead to system instability or deadlocks, affecting the performance and reliability of file sharing services.
Yes, all versions of the Linux kernel in Debian 11, 12, and 13 are affected by this vulnerability. It is crucial to check for updates.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
