Executive brief
A vulnerability exists in the Linux kernel's ksmbd component, which provides SMB file sharing services. By sending multiple simultaneous connection requests, an attacker could trigger a race condition that leads to a system crash or potentially unauthorized data access. This could impact the availability of file services and the confidentiality of stored data.
Technical details
A race condition exists in the ksmbd component of the Linux kernel within the smb2_sess_setup function in fs/smb/server/smb2pdu.c. The vulnerability is caused by improper synchronization when handling Preauth_HashValue during concurrent session setup requests from a single client. Specifically, the code attempted to free sess->Preauth_HashValue during the session setup phase, leading to a potential use-after-free or double-free scenario if multiple requests were processed simultaneously. The fix involves deferring the freeing of this hash value until the connection termination phase. This is reachable over the network without authentication, potentially allowing for remote code execution or denial of service.
Affected products
- Linux Linux Kernel 5.15 to 6.16.1
Timeline
- 2025-07-25: patched: Initial fix authored by Namjae Jeon
- 2025-08-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6
- https://git.kernel.org/stable/c/6613887da1d18dd2ecfd6c6148a873c4d903ebdc
- https://git.kernel.org/stable/c/7d7c0c5304c88bcbd7a85e9bcd61d27e998ba5fc
- https://git.kernel.org/stable/c/b69fd87076daa66f3d186bd421a7b0ee0cb45829
- https://git.kernel.org/stable/c/edeecc7871e8fc0878d53ce286c75040a0e38f6c
- https://git.kernel.org/stable/c/fbf5c0845ed15122a770bca9be1d9b60b470d3aa
- https://www.zerodayinitiative.com/advisories/ZDI-25-916/