Loading story…
Upstream Linux kernel records and a related CVE entry document fixes for two vulnerabilities affecting ksmbd and svcrdma. CVE-2025-68246 impacts ksmbd and is described as a remote socket leakage issue that could let a client consume system resources and degrade service availability, creating a denial-of-service risk for exposed systems.
A second flaw, CVE-2025-68811, affects svcrdma and involves an offset error in a memory copy operation. Public reporting says both issues were explicitly credited in upstream Linux CNA descriptions and fix records to ZeroPath, with the attribution supported by Linux upstream documentation rather than vendor marketing or self-published claims.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE record was created for CVE-2025-68811, describing an offset error in an svcrdma memory copy in the Linux kernel. The provided references do not explicitly anchor the date of the CVE record publication.
Bugflation reported that upstream Linux CNA descriptions and fix records explicitly attributed CVE-2025-68246 and CVE-2025-68811 to ZeroPath. The article highlighted ksmbd remote socket leakage and an svcrdma memory-copy offset error as the affected issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Linux kernel project disclosed and fixed two vulnerabilities in `ksmbd`, the in-kernel SMB server, tracked as **CVE-2024-50283** and **CVE-2024-50286**. Both issues were identified as **slab use-after-free** bugs, a memory-safety flaw class that can lead to kernel crashes, memory corruption, or potentially code execution in privileged context if successfully exploited. The first flaw, **CVE-2024-50283**, affects `smb3_preauth_hash_rsp`, while **CVE-2024-50286** affects `ksmbd_smb2_session_create`. Both vulnerable paths are tied to SMB3 authentication and session establishment, placing the exposure in network-facing code used to process client connections. The fixes were published through the Linux kernel CVE announcement process by Greg Kroah-Hartman, signaling that maintainers have patched the affected `ksmbd` components and that defenders should prioritize kernel updates on systems exposing SMB services.
Jul 12, 2026
Microsoft added several CVEs to its Security Update Guide for Linux kernel components, including **CVE-2026-31609** in SMB, **CVE-2026-31591** in KVM SEV/SNP handling, **CVE-2026-31469** in `virtio_net`, **CVE-2026-31525** in BPF, and **CVE-2026-31494** in the `macb` network driver. The listed issues span memory-safety and logic flaws such as a double-free in `smbd_free_send_io()` after `smbd_send_batch_flush()`, a use-after-free in `virtio_net`, and undefined behavior in the BPF interpreter for signed division and modulo involving `INT_MIN`. The disclosures also include a KVM fix that locks all vCPUs while synchronizing VMSAs during SEV-SNP launch completion, indicating impact in confidential computing and virtualization workflows, alongside a `macb` driver correction for queue statistics handling. Taken together, the entries show Microsoft tracking upstream Linux kernel vulnerabilities across file sharing, virtualization, packet processing, and network drivers, with several bugs carrying potential stability or security impact in environments running affected kernel code paths.
Jul 12, 2026
A newly discussed Linux kernel flaw in the in-kernel SMB server **ksmbd** has been identified as **CVE-2025-37899**, a **use-after-free** bug triggered by a race condition during session handling. Reports say one worker thread can continue using `sess->user` while another thread processing an **SMB2 LOGOFF** request frees that structure, creating a path to memory corruption in kernels affected since **5.15**. The issue drew attention because **ksmbd** was introduced in Linux 5.15 and enabled by default from **5.16**, potentially widening exposure on systems using the feature. The disclosure follows earlier reporting on repeated security problems in **ksmbd** and other Linux networking components, including **CVE-2024-26592**, **CVE-2024-26594**, **CVE-2023-52440**, **CVE-2023-52441**, and **CVE-2023-52442**, alongside the **nf_tables** double-free flaw **CVE-2024-1086**. Prior discussions highlighted that some vulnerable code paths affected broad kernel ranges and distributions, underscoring a continuing pattern of memory-management bugs in kernel subsystems exposed through SMB and packet-filtering functionality.
Jun 29, 2026