CVE-2025-37926

What it actually does

Use-after-free in ksmbd due to unprotected race between ksmbd_session_rpc_open and __session_rpc_close allowing local memory corruption.

Why it matters to the business

Local attackers on affected Ubuntu AWS kernels can gain full system control or crash servers, risking data breach and service disruption; patch urgency is moderate given low exploit maturity and prevalence limited to specific 5.15 AWS packages.

How an attack unfolds

A local process opens an SMB session via ksmbd while another concurrently closes it, triggering the unprotected race that frees the rpc structure before use; the attacker then reuses the dangling pointer for arbitrary read/write or code execution.

How to fix it

Upgrade linux-aws-5.15 packages on Ubuntu 20.04 LTS to version 5.15.0-1072.78~20.04.1 or later; disable ksmbd if SMB server functionality is not required.

How to confirm the fix worked

Confirm kernel package version is at or above 5.15.0-1072.78~20.04.1 and verify absence of the race window by reviewing the added rpc_lock in ksmbd session code.

Typical attack path

1. Obtain local shell on target Ubuntu 20.04 AWS instance running vulnerable 5.15 ksmbd kernel
2. Trigger concurrent ksmbd_session_rpc_open and __session_rpc_close calls via crafted SMB or local process activity
3. Reuse freed rpc object to corrupt kernel memory and escalate privileges or execute code

How to detect it

Review kernel logs for oops/panic traces referencing ksmbd_session_rpc_open or __session_rpc_close; inspect for unusual local processes interacting with ksmbd sockets.

What your security team should do

• Apply the listed kernel update to all affected Ubuntu 20.04 AWS instances within standard change windows
• Audit systems for ksmbd usage and disable the module where SMB server services are unnecessary
• Monitor EPSS and exploit maturity indicators for any future rise in risk