Critical Use-After-Free Vulnerability in Linux Kernel (Debian:13 & Debian:14)
Summary
DEBIAN-CVE-2025-37776: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_break_all_levII_oplock() There is a room in smb_break_all_levII_oplock that can cause racy issues when unlocking in the... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel is known for its stability and performance, but like any complex software, it can have vulnerabilities that may affect system security and functionality. This specific vulnerability affects the ksmbd module, which is responsible for SMB (Server Message Block) file sharing, allowing for file and printer sharing between computers on a network.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified in the ksmbd module, specifically in the smb_break_all_levII_oplock() function. This vulnerability arises from a race condition that can occur when unlocking resources in the middle of a loop, potentially leading to memory corruption and exploitation by an attacker. If successfully exploited, this vulnerability could allow unauthorized access to sensitive data or system resources, posing a significant risk to system integrity and security.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified use-after-free vulnerability in the Linux kernel's ksmbd module poses a significant risk to system security. It is crucial for users of Debian:13 and Debian:14 to update their systems to the patched version 6.12.25-1 to mitigate potential threats. Regular updates and monitoring for vulnerabilities are essential practices for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to memory corruption and exploitation.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install additional software.
Exploitation of this vulnerability could allow attackers to gain unauthorized access to sensitive data, execute arbitrary code, or disrupt system operations.
Yes, the vulnerability affects versions prior to 6.12.25-1 in both Debian:13 and Debian:14.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
