VULNERABILITY INTELLIGENCE

CVE-2025-37924

CVSS score9.8 CRITICAL
EPSS probability24.55%
CISA KEVNot currently listed
Published2025-05-20
Last modified2026-10-15
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL.

Weakness classification

  • nvd@nist.gov: CWE-416

Primary references