PT-2025-22161 · Linux+5 · Linux Kernel+5

Published 2025-04-21 · Updated 2026-05-26 · CVE-2025-37899

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel

Description: A use-after-free vulnerability exists in the ksmbd module of the Linux kernel, specifically in the smb2 sess setup function. This flaw could allow a remote attacker to cause a denial of service. The vulnerability was discovered using OpenAI’s o3 model, which analyzed code to identify the issue. The model identified a race condition in the SMB logoff handler, leading to the use-after-free vulnerability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

RCE

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-06026

CVE-2025-37899

ECHO-1E9D-9C2B-8B11

USN-7649-1

USN-7649-2

USN-7650-1

USN-7665-1

USN-7665-2

USN-7721-1

USN-8059-1

USN-8059-2

USN-8059-3

USN-8059-4

USN-8059-5

USN-8059-6

USN-8059-7

USN-8059-8

USN-8059-9

USN-8125-1

USN-8126-1

Affected Products

Astra Linux

Debian

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 1429

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37899.json · Exploit
• 🔥 https://github.com/SeanHeelan/o3_finds_cve-2025-37899/tree/master · Exploit
• 🔥 https://news.ycombinator.com/item?id=44081338 · Exploit
• 🔥 https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation · Exploit
• https://ubuntu.com/security/CVE-2025-38059 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-23145 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38181 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-23143 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40061 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38192 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39949 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37784 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38021 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40036 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37811 · Vendor Advisory