{"id":"CVE-2025-37899","published":"2025-05-20T15:21:34Z","modified":"2026-08-05T11:58:10Z","title":"ksmbd: fix use-after-free in session logoff","vendor":"Linux","product":"Linux","tier":"core","eol":null,"affectedVersions":[{"vendor":"Linux","product":"Linux","versions":[">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 931dc8a3670f71c45c0b1379ea4e92dafbda1aca",">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 70ad6455139e26e85f48f95d0e21f351c1909342",">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < d5ec1d79509b3ee01de02c236f096bc050221b7f",">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 02d16046cd11a5c037b28c12ffb818c56dd3ef43",">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 2fc9feff45d92a92cd5f96487655d5be23fb7e2b"]},{"vendor":"Linux","product":"Linux","versions":["5.15"]}],"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in session logoff\n\nThe sess->user object can currently be in use by another thread, for\nexample if another connection has sent a session setup request to\nbind to the session being free'd. The handler for that connection could\nbe in the smb2_sess_setup function which makes use of sess->user.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00882,"percentile":0.59166,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-09","exploitedFirstSeen":"2025-10-09","ransomware":false,"evidence":[{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://git.kernel.org/stable/c/931dc8a3670f71c45c0b1379ea4e92dafbda1aca","tags":[]},{"url":"https://git.kernel.org/stable/c/70ad6455139e26e85f48f95d0e21f351c1909342","tags":[]},{"url":"https://git.kernel.org/stable/c/d5ec1d79509b3ee01de02c236f096bc050221b7f","tags":[]},{"url":"https://git.kernel.org/stable/c/02d16046cd11a5c037b28c12ffb818c56dd3ef43","tags":[]},{"url":"https://git.kernel.org/stable/c/2fc9feff45d92a92cd5f96487655d5be23fb7e2b","tags":[]},{"url":"https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/","tags":[]},{"url":"https://news.ycombinator.com/item?id=44081338","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-15946","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15946","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2025-05-22","earliestUrl":"https://github.com/SeanHeelan/o3_finds_cve-2025-37899","repos":[{"name":"SeanHeelan/o3_finds_cve-2025-37899","url":"https://github.com/SeanHeelan/o3_finds_cve-2025-37899","stars":354,"created":"2025-05-22"},{"name":"ccss17/o3_finds_cve-2025-37899","url":"https://github.com/ccss17/o3_finds_cve-2025-37899","stars":0,"created":"2025-09-11"}]},"first":{"date":"2025-05-22","source":"PoC-in-GitHub","url":"https://github.com/SeanHeelan/o3_finds_cve-2025-37899"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-05-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-37899","provenance":"source"},{"date":"2025-05-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/SeanHeelan/o3_finds_cve-2025-37899","provenance":"source"},{"date":"2025-10-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":58.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 388 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":11.83,"detail":"percentile 0.5917"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}