VYPR
Get started
← All advisories
Critical severity9.8NVD Advisory· Published May 20, 2025· Updated Apr 2, 2026

CVE-2025-37924

CVE-2025-37924

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in kerberos authentication

Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL.

Affected products

6
  • Debian/Debian Linux
    cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
  • Linux/Kernel5 versions
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=5.15,<6.1.138
    • cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*

Patches

5
e34a33d5d7e8
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
b44746356223
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
e18c61671801
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
28c756738af4
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
e86e9134e1d1
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.