PT-2025-51676 · Linux+3 · Linux Kernel+3
Published
2025-11-30
·
Updated
2026-05-11
·
CVE-2025-68263
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel’s ksmbd module contains a use-after-free issue within the ipc msg send request function. Specifically, the function waits for a generic netlink reply using an ipc msg table entry on the stack. The generic netlink handler fills entry->response under ipc msg table lock, but ipc msg send request previously validated and freed entry->response without holding the same lock. This allowed a race condition where handle response was copying data into entry->response while ipc msg send request had already freed it, leading to a slab-use-after-free. The issue was triggered by a concurrency scenario and reported by KASAN in handle generic event. The fix involves taking ipc msg table lock in ipc msg send request while validating entry->response, freeing it when invalid, and removing the entry from ipc msg table. The final entry->response pointer is returned to the caller only after the hash entry is removed under the lock.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Ubuntu