CVE-2025-68817

What it actually does

Use-after-free in ksmbd_tree_connect_put where a tree-connection object is freed on one concurrent disconnect path while another path retains a reference and performs subsequent put or write operations on the freed object.

Why it matters to the business

Local attackers can achieve arbitrary code execution with kernel privileges on Linux systems exposing ksmbd, resulting in full host compromise, data theft, or persistence; high prevalence of Linux kernels increases organizational exposure.

How an attack unfolds

An attacker with local access triggers concurrent SMB tree-connect and disconnect operations against ksmbd; the race frees the tcon object on one path while the other path dereferences it, enabling memory corruption that is turned into kernel code execution.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.15.199 or apply commit 446beed646b2e426dd53d27358365f8678e1dd01; disable ksmbd if SMB server functionality is not required.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds a listed fixed release and verify the vulnerable ksmbd_tree_connect_put code path is absent via source inspection or kernel symbol checks.

Typical attack path

1. Obtain local unprivileged access to a Linux host running ksmbd
2. Issue concurrent SMB tree connect and disconnect requests to induce the race
3. Trigger use-after-free on the freed tcon object via put/write
4. Leverage resulting memory corruption for privilege escalation to kernel

How to detect it

Review kernel logs for ksmbd-related crashes, oops, or use-after-free warnings around SMB tree connect activity; no public exploitation artifacts are known.

What your security team should do

• Apply the listed kernel updates or commit across all affected systems without delay
• Disable ksmbd where SMB serving is unnecessary to reduce attack surface
• Audit systems for ksmbd usage and prioritize patching of internet-facing or multi-user hosts