Critical Use-After-Free Vulnerability in Linux Kernel: linux Package Affected
Summary
DEBIAN-CVE-2025-37899: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if another connection has sent... Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux package is a core component of the Debian operating system, providing the Linux kernel that manages system resources and hardware interactions. It is essential for the functioning of the OS, enabling processes, memory management, and device control. This vulnerability specifically affects the ksmbd module, which handles SMB (Server Message Block) protocol for file sharing and network communication.
Vulnerability Detail
In the Linux kernel, a critical vulnerability has been identified in the ksmbd module, where a use-after-free condition occurs during session logoff. This vulnerability arises when the sess->user object is still in use by another thread while the session is being freed. If another connection sends a session setup request to bind to the session being freed, it can lead to undefined behavior, potentially allowing an attacker to exploit this flaw for unauthorized access or denial of service.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The identified use-after-free vulnerability in the Linux kernel's ksmbd module poses significant risks to systems running the linux package. Users are urged to update to the patched version to mitigate potential threats. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to memory corruption or execution of arbitrary code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install additional software.
Exploitation of this vulnerability could allow an attacker to gain unauthorized access to system resources, disrupt services, or execute arbitrary code, leading to severe security breaches.
Yes, if exploited, this vulnerability could lead to data corruption or loss, as unauthorized access may allow attackers to manipulate or delete critical data.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed, to ensure your system remains secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
