Race Condition in Linux Kernel's Ksmbd Affects Multiple Session Setup Requests
CVE-2025-38561
Key Information:
Badges
What is CVE-2025-38561?
A vulnerability in the ksmbd component of the Linux kernel can lead to a race condition when clients send multiple session setup requests. This issue arises due to the improper management of the Preauh_HashValue, which does not require freeing at the session setup phase. Instead, it should be freed alongside the session during the connection termination phase, ensuring resource management is handled correctly to avoid potential exploit scenarios.
Affected Version(s)
Linux 0626e6641f6b467447c81dd7678a69c66f7746cf
Linux 0626e6641f6b467447c81dd7678a69c66f7746cf
Linux 0626e6641f6b467447c81dd7678a69c66f7746cf
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.