Memory Leak Vulnerability in Linux Kernel's ksmbd Package
Summary
CVE-2025-37962: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leak in parse_lease_state() The previous patch that added bounds check for create lease context introduced a memory leak. Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system operations. The ksmbd module allows for SMB (Server Message Block) protocol support, enabling file sharing and printing services over a network. This vulnerability affects Debian versions 12 and 13 of the Linux kernel, which are widely used in various distributions.
Vulnerability Detail
The vulnerability, identified as CVE-2025-37962, arises from a memory leak in the ksmbd module's parse_lease_state() function. A recent patch introduced bounds checks for creating lease contexts, but it inadvertently caused a memory leak. When the bounds check fails, the function returns NULL without freeing the previously allocated lease_ctx_info structure, leading to potential memory exhaustion and degraded system performance.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate any risks associated with the memory leak.
Conclusion
The CVE-2025-37962 vulnerability in the Linux kernel's ksmbd module presents a significant risk due to a memory leak issue. Users are encouraged to update their systems promptly to mitigate potential impacts. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37962 is a vulnerability in the Linux kernel's ksmbd module that causes a memory leak due to improper handling of lease context bounds checks.
This vulnerability can lead to memory exhaustion, which may degrade system performance and stability over time.
Yes, Debian versions 12 and 13 of the Linux kernel are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and apply the patch as soon as it is available.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
