CVE-2025-22040

What it actually does

Race condition in ksmbd allows a session object to be freed via ksmbd_sessions_deregister before a multichannel connection is attached to its channel list, resulting in use-after-free on subsequent session operations.

Why it matters to the business

Remote attackers with authenticated SMB access can trigger kernel memory corruption on Linux servers exposing ksmbd, potentially leading to system crashes, privilege escalation, or full host compromise; low immediate urgency given absence from KEV and modest EPSS, but kernel-level impact affects any organization running unpatched SMB servers.

How an attack unfolds

An authenticated attacker initiates a multichannel SMB session setup while concurrently triggering session deregistration; the missing reference count check allows the session to be freed before the connection is linked, enabling the attacker to reuse the dangling pointer for memory corruption or control-flow hijacking.

How to fix it

Apply the upstream fix (commit 596407adb9af1ee75fe7c7529607783d31b66e7f) or later; rebuild and deploy updated Linux kernels containing the reference-count check before freeing sessions. Where distribution packages are available, upgrade to the versions listed for each affected component.

How to confirm the fix worked

Verify the presence of the reference-count guard in ksmbd_session.c around the deregister path; confirm kernel builds contain commit 596407adb9af1ee75fe7c7529607783d31b66e7f; test multichannel session creation and teardown under load to ensure no UAF occurs.

Typical attack path

1. Establish an SMB connection to a ksmbd-enabled Linux target
2. Negotiate and initiate multichannel session setup
3. Trigger concurrent session deregistration via logout or timeout path
4. Reuse the freed session object through the pending channel attachment
5. Achieve arbitrary kernel read/write or code execution

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for use-after-free warnings or oops involving ksmbd_sessions_deregister or session channel list operations; correlate with SMB authentication events around the time of any crash.

What your security team should do

• Prioritize kernel updates on all systems exposing ksmbd to untrusted networks
• Disable ksmbd if SMB server functionality is not required
• Monitor for kernel oops or panic logs containing ksmbd session references
• Apply network segmentation to limit SMB exposure until patches are deployed