Loading story…
A newly discussed Linux kernel flaw in the in-kernel SMB server ksmbd has been identified as CVE-2025-37899, a use-after-free bug triggered by a race condition during session handling. Reports say one worker thread can continue using sess->user while another thread processing an SMB2 LOGOFF request frees that structure, creating a path to memory corruption in kernels affected since 5.15. The issue drew attention because ksmbd was introduced in Linux 5.15 and enabled by default from 5.16, potentially widening exposure on systems using the feature.
The disclosure follows earlier reporting on repeated security problems in ksmbd and other Linux networking components, including CVE-2024-26592, CVE-2024-26594, CVE-2023-52440, CVE-2023-52441, and CVE-2023-52442, alongside the nf_tables double-free flaw CVE-2024-1086. Prior discussions highlighted that some vulnerable code paths affected broad kernel ranges and distributions, underscoring a continuing pattern of memory-management bugs in kernel subsystems exposed through SMB and packet-filtering functionality.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A forum discussion published on 2025-05-25 describes CVE-2025-37899, a use-after-free flaw in the Linux kernel's ksmbd component caused by a race between a worker thread using sess->user and an SMB2 LOGOFF handler freeing that structure. The discussion says ksmbd was introduced in Linux 5.15, enabled by default from 5.16, and that kernels from 5.15 onward are affected.
A reference published on 2025-01-29 indicates the Linux kernel received a new release with around 40 changes or fixes. The provided content does not include enough detail to tie this to a specific security event beyond the release itself.
Discussion published on 2024-03-27 references disclosure of multiple Linux kernel flaws, including nf_tables double-free CVE-2024-1086 and several ksmbd issues such as CVE-2024-26592, CVE-2024-26594, CVE-2023-52440, CVE-2023-52441, and CVE-2023-52442. The reports note affected kernel ranges spanning older and newer releases, including ksmbd-related exposure in modern Linux kernels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
opennet.me
Open sourceopennet.ru
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Linux kernel project disclosed and fixed two vulnerabilities in `ksmbd`, the in-kernel SMB server, tracked as **CVE-2024-50283** and **CVE-2024-50286**. Both issues were identified as **slab use-after-free** bugs, a memory-safety flaw class that can lead to kernel crashes, memory corruption, or potentially code execution in privileged context if successfully exploited. The first flaw, **CVE-2024-50283**, affects `smb3_preauth_hash_rsp`, while **CVE-2024-50286** affects `ksmbd_smb2_session_create`. Both vulnerable paths are tied to SMB3 authentication and session establishment, placing the exposure in network-facing code used to process client connections. The fixes were published through the Linux kernel CVE announcement process by Greg Kroah-Hartman, signaling that maintainers have patched the affected `ksmbd` components and that defenders should prioritize kernel updates on systems exposing SMB services.
Jul 12, 2026
Red Hat and the Linux kernel CVE team disclosed **CVE-2026-31709**, an Important-severity flaw in the Linux kernel SMB client’s `cifsacl` code that can be triggered by a malicious SMB server. The bug stems from insufficient validation of a server-supplied DACL during `chmod` and `chown` security descriptor handling, allowing a truncated DACL with a valid header and overstated ACE count to drive out-of-bounds reads or copies in `fs/smb/client/cifsacl.c`. Red Hat assigned the issue a CVSS v3 score of **7.8** and said successful exploitation could cause memory corruption, information disclosure, or denial of service. The vulnerable code was introduced in kernel **5.12**, and the fix adds a shared `validate_dacl()` routine with full DACL and per-ACE bounds checks, which is also reused by `parse_dacl()` for consistent validation. Red Hat said corrected kernel packages have been released across multiple product streams including **RHEL 8, RHEL 9, and RHEL 10**, while **RHEL 6** is not affected because the vulnerable code is absent; the issue is also included in **RHSA-2026:23329** for RHEL 10. Red Hat advised customers to apply the updated kernel packages and reboot affected systems, and said organizations that do not need SMB client functionality can mitigate exposure by blacklisting the `cifs` kernel module.
Aug 25, 2026
Red Hat disclosed two **Important** Linux kernel vulnerabilities in the SMB client’s `cifsacl` handling that can be triggered by a malicious SMB server and lead to memory corruption. **`CVE-2026-31709`** affects DACL parsing when a server advertises more ACEs than are actually present, causing insufficient validation and resulting in out-of-bounds memory read or copy behavior. Red Hat said the flaw can cause information disclosure or denial of service and assigned it a CVSS v3 score of **7.8**. A second flaw, **`CVE-2026-46195`**, affects **32-bit** Red Hat Enterprise Linux systems and stems from a crafted `dacloffset` value that can trigger pointer wrap during `chmod` or `chown` operations, leading to invalid DACL dereferences and memory corruption. Red Hat warned the issue could cause denial of service or bypass security mechanisms, scored it **7.5**, and mapped it to **`CWE-787`**, a class of out-of-bounds write weaknesses that can corrupt memory and potentially alter program control flow. Red Hat published fixes across multiple RHEL 8 and 9 kernel streams, noted some product variants remained affected at disclosure, and advised organizations that do not need SMB client functionality to blacklist the `cifs` kernel module as a mitigation.
Aug 25, 2026