CVE-2025-37924
Critical · 9.8CVSS
9.8
EPSS
22.1%
Published
May 20, 2025
CISA due date
—
The record
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux-6.1 | 0 | 6.1.140-1~deb11u1 |
| Debian:12 | linux | 0 | 6.1.140-1 |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.29-1 |
| Debian:14 | linux | 0 | 6.12.29-1 |
| Linux | Kernel | 5.15.0 | 6.1.138 |
| Mageia:9 | dwarves | 0 | 1.30-1.mga9 |
| Mageia:9 | kernel | 0 | 6.6.93-1.mga9 |
| Mageia:9 | kernel-firmware | 0 | 20250509-1.mga9 |
| Mageia:9 | kernel-firmware-nonfree | 0 | 20250509-1.mga9.nonfree |
| Mageia:9 | kernel-linus | 0 | 6.6.93-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.1.8-3.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-80.mga9 |
| Mageia:9 | libtraceevent | 0 | 1.8.4-1.mga9 |
| Mageia:9 | libtracefs | 0 | 1.8.2-1.mga9 |
| Mageia:9 | radeon-firmware | 0 | 20250509-1.mga9.nonfree |
| Mageia:9 | wireless-regdb | 0 | 20250220-1.mga9 |
Related vulnerabilities
- CVE-2025-21760 In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU… Also affects linux-6.1
- CVE-2025-21758 In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU… Also affects linux-6.1
- CVE-2025-21664 In the Linux kernel, the following vulnerability has been resolved: dm thin: make… Also affects linux-6.1
- CVE-2024-57946 In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't… Also affects linux-6.1
- CVE-2024-57945 In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the… Also affects linux-6.1
- CVE-2025-21660 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix… Also affects linux-6.1
- CVE-2025-21662 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix… Also affects linux-6.1
- CVE-2024-57940 In the Linux kernel, the following vulnerability has been resolved: exfat: fix the… Also affects linux-6.1