CVE-2025-22041

What it actually does

Use-after-free in ksmbd_sessions_deregister() during multichannel SMB session setup, where a session freed via the global table remains accessible through the connection's sessions list.

Why it matters to the business

Remote attackers with valid SMB credentials can achieve arbitrary code execution on affected enterprise Linux systems, risking data theft, ransomware deployment, or full host compromise; high prevalence in Red Hat environments increases exposure for organizations running unpatched kernels.

How an attack unfolds

An attacker establishes an SMB multichannel connection, registers a session on the first channel, then triggers deregistration while the second channel still references the freed session object through the connection structure, leading to memory corruption and potential control-flow hijacking.

How to fix it

Upgrade all listed affected packages to version 0:4.18.0-372.129.1.el8_6 or later; apply the vendor kernel update immediately and reboot systems; disable ksmbd if multichannel SMB is not required.

How to confirm the fix worked

Verify installed kernel version matches or exceeds 4.18.0-372.129.1.el8_6; review kernel changelog for the ksmbd_sessions_deregister fix; test multichannel session teardown under load in a lab environment.

Typical attack path

1. Obtain valid low-privileged SMB credentials on the target
2. Initiate multichannel SMB session negotiation
3. Register session via first channel and trigger concurrent deregistration
4. Access dangling session pointer via second channel's connection list
5. Trigger use-after-free to corrupt kernel memory and execute payload

How to detect it

Search kernel logs and audit trails for ksmbd session registration/deregistration errors or crashes around multichannel SMB activity; correlate with unexpected process terminations or memory corruption indicators in dmesg.

What your security team should do

• Apply the fixed kernel packages within 30 days given the high CVSS and enterprise exposure
• Restrict SMB access to trusted networks and enforce strong authentication
• Monitor for unusual ksmbd session activity in system logs
• Plan phased rollout and kernel compatibility testing for production workloads