CVE-2025-37962

What it actually does

Memory leak in ksmbd parse_lease_state() where bounds check failure on create lease context returns NULL without freeing the previously allocated lease_ctx_info structure.

Why it matters to the business

Repeated triggering on Linux servers handling SMB traffic can gradually exhaust kernel memory, leading to performance degradation or service instability in high-connection environments; low urgency given low EPSS and no KEV listing.

How an attack unfolds

An attacker sends crafted SMB create requests containing lease contexts that fail the added bounds checks, causing parse_lease_state to leak the allocated lease_ctx_info on each failure; related Linux kernel privilege-escalation activity by threat actors has targeted similar ksmbd paths but no direct exploitation of this leak is recorded.

How to fix it

Upgrade the Linux kernel to the version containing commit facf22c1a394c1e023dab5daf9a494f722771e1c or later stable releases that include the kfree(lreq) fix in both boundary-check return paths.

How to confirm the fix worked

Confirm the applied kernel contains facf22c1a394c1e023dab5daf9a494f722771e1c; recompile or test with lease-context inputs that previously failed bounds checks and verify no leak occurs via memory accounting tools.

Typical attack path

1. Establish SMB session to a vulnerable ksmbd server
2. Send create request with lease context that violates bounds checks
3. Trigger repeated allocation without free path
4. Monitor for gradual kernel memory growth leading to resource exhaustion

How to detect it

Watch for sustained increases in kernel slab or ksmbd-related memory allocations correlated with SMB create/lease traffic; review system logs and memory profilers for patterns matching repeated parse_lease_state calls without corresponding frees.

What your security team should do

• Prioritize kernel upgrade to facf22c1a394c1e023dab5daf9a494f722771e1c on all systems exposing ksmbd
• Monitor kernel memory usage on SMB servers for unexpected growth
• Disable ksmbd if SMB services are not required until patched
• Track EPSS trend and any new threat-actor activity around related ksmbd CVEs