CVE-2025-38561

What it actually does

Race condition in ksmbd session setup allows concurrent requests to interfere with Preauh_HashValue handling, potentially leading to use-after-free or inconsistent state when the value is freed prematurely instead of at connection termination.

Why it matters to the business

Linux systems running the affected kernel versions face elevated risk of local privilege escalation or denial of service in SMB server functionality, especially in environments with high session setup traffic; widespread kernel prevalence increases exposure across servers and containers despite low exploit probability.

How an attack unfolds

An attacker with network access to the ksmbd service sends multiple overlapping session setup requests to trigger the race on Preauh_HashValue, attempting to cause memory corruption or inconsistent session state before the value is properly released at connection close.

How to fix it

Update the Linux kernel to a version containing commit fbf5c0845ed15122a770bca9be1d9b60b470d3aa or later; for Chainguard packages apply openjdk-17-openj9 updates to 0.53.0-r0 or newer that incorporate the fix; rebuild and redeploy any custom kernels or container images using affected sources.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or package version; inspect ksmbd session handling code to confirm Preauh_HashValue is no longer freed during setup; test with concurrent session setup workloads to ensure no premature free occurs.

Typical attack path

1. Identify reachable ksmbd instance via network scanning
2. Establish initial SMB connection and issue rapid sequence of session setup requests
3. Trigger race condition on Preauh_HashValue allocation and free operations
4. Exploit resulting memory state for privilege escalation or crash

How to detect it

Review kernel logs and SMB audit trails for repeated session setup attempts from the same client IP within short time windows; look for ksmbd crashes or oops messages around session termination; correlate with any unexplained privilege changes or container escapes on affected systems.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-tenant systems within standard patch windows given low EPSS
• Monitor for related kernel privilege escalation activity from listed threat actor patterns
• Apply defense-in-depth by restricting SMB exposure and enabling kernel hardening features
• Include the fixed commit in automated vulnerability scanning and SBOM processes