CVE-2025-68817 (GCVE-0-2025-68817)
Vulnerability from cvelistv5
Published
2026-01-13 15:29
Modified
2026-08-05 12:11
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it.
References
Impacted products
Vendor Product Version
Linux Linux Version: dd45db4d9bbc8f122a9b4db5ce94ae29fcf03d3c
Version: 7b58ee8d0b91359554cf219cd4f33872ea2afd66
Version: 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e
Version: 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e
Version: 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e
Version: 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e
Version: 5.15.145   ≤
Version: 6.1.71   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/tree_connect.c",
            "fs/smb/server/mgmt/tree_connect.h",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "446beed646b2e426dd53d27358365f8678e1dd01",
              "status": "affected",
              "version": "dd45db4d9bbc8f122a9b4db5ce94ae29fcf03d3c",
              "versionType": "git"
            },
            {
              "lessThan": "d092de8a26c952379ded8e6b0bda31d89befac1a",
              "status": "affected",
              "version": "7b58ee8d0b91359554cf219cd4f33872ea2afd66",
              "versionType": "git"
            },
            {
              "lessThan": "d64977495e44855f2b28d8ce56107c963a7a50e4",
              "status": "affected",
              "version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e",
              "versionType": "git"
            },
            {
              "lessThan": "21a3d01fc6db5129f81edb0ab7cb94fd758bcbea",
              "status": "affected",
              "version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e",
              "versionType": "git"
            },
            {
              "lessThan": "063cbbc6f595ea36ad146e1b7d2af820894beb21",
              "status": "affected",
              "version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e",
              "versionType": "git"
            },
            {
              "lessThan": "b39a1833cc4a2755b02603eec3a71a85e9dff926",
              "status": "affected",
              "version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.199",
              "status": "affected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.160",
              "status": "affected",
              "version": "6.1.71",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/tree_connect.c",
            "fs/smb/server/mgmt/tree_connect.h",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "5.15.145",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "6.1.71",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency\n\nUnder high concurrency, A tree-connection object (tcon) is freed on\na disconnect path while another path still holds a reference and later\nexecutes *_put()/write on it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd processes remotely supplied SMB2/3 requests over TCP port 445, with the request path reaching smb2_tree_disconnect and ksmbd_tree_connect_put in kernel context.\nAC:L - A remote client can control both sides by issuing concurrent tree-scoped requests and SMB2_TREE_DISCONNECT against its own tree connection. ksmbd permits thousands of in-flight work items, allowing repeated race attempts without conditions outside attacker control.\nPR:N - The path requires a valid SMB session and tree ID, but ksmbd supports public guest shares and skips password verification for guest accounts. An attacker can therefore establish the required session and tree without credentials in a reasonable deployment.\nUI:N - Once the SMB server and share are available, the attacker triggers the race entirely through network requests without victim action.\nS:U - The UAF corrupts the ksmbd host kernel within the same security authority; it does not inherently cross a VM, IOMMU, or other separate security boundary.\nC:H - The final reference release accesses the freed tcon wait-queue list, which can operate on attacker-influenced contents after heap reclamation. This kernel UAF can plausibly provide arbitrary memory disclosure rather than only a bounded leak.\nI:H - wake_up can lock and traverse the reclaimed wait queue, causing writes and an indirect function call through stale contents. Heap spraying can therefore support arbitrary write or kernel control-flow hijacking.\nA:H - Invalid wait-queue pointers, corrupted lock state, or a stale indirect call can cause a kernel oops or panic. The remotely controlled race can be attempted repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:44.783Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/446beed646b2e426dd53d27358365f8678e1dd01"
        },
        {
          "url": "https://git.kernel.org/stable/c/d092de8a26c952379ded8e6b0bda31d89befac1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d64977495e44855f2b28d8ce56107c963a7a50e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/21a3d01fc6db5129f81edb0ab7cb94fd758bcbea"
        },
        {
          "url": "https://git.kernel.org/stable/c/063cbbc6f595ea36ad146e1b7d2af820894beb21"
        },
        {
          "url": "https://git.kernel.org/stable/c/b39a1833cc4a2755b02603eec3a71a85e9dff926"
        }
      ],
      "title": "ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68817",
    "datePublished": "2026-01-13T15:29:21.210Z",
    "dateReserved": "2025-12-24T10:30:51.048Z",
    "dateUpdated": "2026-08-05T12:11:44.783Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.