CVE-2025-37778

CriticalCVSS 9.8

Published: 01/05/2025(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

40th percentile - higher than 40% of all known CVEs

Summary

In the Linux kernel, the ksmbd subsystem (SMB server) has a dangling pointer issue in krb_authenticate. The function frees sess->user but does not set the pointer to NULL. It then calls ksmbd_krb5_authenticate, which may not reinitialize sess->user, leading to access of freed memory in smb2_sess_setup.

Risk Assessment

The vulnerability could lead to SMB server crashes or potentially code execution in kernel context, posing a serious security threat.

Recommendation

Apply the Linux kernel update containing the fix for CVE-2025-37778. Ensure systems with ksmbd enabled are updated.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL. It calls ksmbd_krb5_authenticate to reinitialise sess->user but that function may return without doing so. If that happens then smb2_sess_setup, which calls krb_authenticate, will be accessing free'd memory when it later uses sess->user.