CVE-2025-68263ksmbd: ipc: fix use-after-free in ipc_msg_send_request
- 9.8CriticalCVSS base score
- 0.44%Exploitation in 30 daysEPSS · top 61% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock. Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event(): BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd] Write of size 12 at addr ffff888198ee6e20 by task pool/109349 ... Freed by task: kvfree ipc_msg_send_request [ksmbd] ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd] Fix by: - Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table. - Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock. - Returning NULL in the error path, preserving the original API semantics. This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.
Timeline
ID reserved
By Linux
Published
- 10 months later
· 10 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.44% · top 61% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected 0626e6641f6b467447c81dd7678a69c66f7746cf – < de85fb58f9967ba024bb08e0041613d37b57b4d1
- affected 0626e6641f6b467447c81dd7678a69c66f7746cf – < 708a620b471a14466f1f52c90bf3f65ebdb31460
- affected 0626e6641f6b467447c81dd7678a69c66f7746cf – < 5ac763713a1ef8f9a8bda1dbd81f0318d67baa4e
- affected 0626e6641f6b467447c81dd7678a69c66f7746cf – < 759c8c30cfa8706c518e56f67971b1f0932f4b9b
- affected 0626e6641f6b467447c81dd7678a69c66f7746cf – < 8229c6ca50cea701e25a7ee25f48441b582ec5fa
- affected 0626e6641f6b467447c81dd7678a69c66f7746cf – < 1fab1fa091f5aa97265648b53ea031deedd26235
- affected 5.15
- unaffected < 5.15
- unaffected 6.1.160 – ≤ 6.1.*
- unaffected 6.6.120 – ≤ 6.6.*
- unaffected 6.12.62 – ≤ 6.12.*
- unaffected 6.17.12 – ≤ 6.17.*
- unaffected 6.18.1 – ≤ 6.18.*
- unaffected 6.19 – ≤ *
References
References6
- https://git.kernel.org/stable/c/de85fb58f9967ba024bb08e0041613d37b57b4d1 (opens in a new tab)
- https://git.kernel.org/stable/c/708a620b471a14466f1f52c90bf3f65ebdb31460 (opens in a new tab)
- https://git.kernel.org/stable/c/5ac763713a1ef8f9a8bda1dbd81f0318d67baa4e (opens in a new tab)
- https://git.kernel.org/stable/c/759c8c30cfa8706c518e56f67971b1f0932f4b9b (opens in a new tab)
- https://git.kernel.org/stable/c/8229c6ca50cea701e25a7ee25f48441b582ec5fa (opens in a new tab)
- https://git.kernel.org/stable/c/1fab1fa091f5aa97265648b53ea031deedd26235 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-203745 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-68263)Record last updated .