CVE-2025-22040 — Use After Free in Linux
Severity
8.8HIGHNVD
OSV7.1OSV5.9
EPSS
0.1%
top 65.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 16
Latest updateJan 9
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix session use-after-free in multichannel connection
There is a race condition between session setup and
ksmbd_sessions_deregister. The session can be freed before the connection
is added to channel list of session.
This patch check reference count of session before freeing it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages8 packages
▶CVEListV5linux/linux0626e6641f6b467447c81dd7678a69c66f7746cf — 596407adb9af1ee75fe7c7529607783d31b66e7f+6
Also affects: Debian Linux 11.0