CVE-2025-38437

What it actually does

Potential use-after-free in ksmbd when ksmbd_iov_pin_rsp returns an error during oplock or lease break acknowledgment, allowing access to freed opinfo state and duplicate calls to opinfo_put and ksmbd_fd_put.

Why it matters to the business

Linux servers providing SMB file shares may suffer crashes, resource corruption, or privilege escalation, leading to service outages and potential unauthorized access on Debian 12 deployments until upgraded.

How an attack unfolds

An attacker establishes an SMB session and forces an oplock or lease break condition; when response pinning fails, the resulting use-after-free can be leveraged for memory corruption, potentially chaining into privilege escalation observed in Linux kernel campaigns by actors such as Advanced Spyware Campaign or September 2025 Active Exploitation Campaigns.

How to fix it

Upgrade the linux package on Debian 12 to version 6.1.147-1 or newer; reboot to load the fixed kernel and validate SMB share functionality post-update.

How to confirm the fix worked

Confirm running kernel version meets or exceeds 6.1.147-1 via uname or package manager; exercise oplock/lease SMB operations under load to verify stability and absence of prior double-free paths.

Typical attack path

1. Connect to ksmbd SMB service and negotiate session
2. Trigger oplock or lease acquisition followed by break request
3. Induce error return from ksmbd_iov_pin_rsp
4. Access freed opinfo structures to corrupt kernel memory
5. Escalate to code execution or denial of service

How to detect it

Inspect kernel logs for oops or panic entries referencing ksmbd oplock or lease handling; correlate with SMB connection logs showing abnormal break acknowledgment sequences during the exploitation window.

What your security team should do

• Prioritize kernel upgrade to 6.1.147-1 across all Debian 12 hosts exposing SMB
• Review and restrict unnecessary SMB exposure while monitoring for kernel oops involving ksmbd
• Incorporate this fix into standard patching cycles given rising EPSS trend and related kernel exploit activity