CVE-2025-21945 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2025-21945?

CVE-2025-21945 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's ksmbd (SMB server) component. When handling SMB2 lock operations with zero-length locks, improper cleanup during error handling can lead to memory corruption. This affects systems running vulnerable Linux kernel versions with ksmbd enabled.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's ksmbd (SMB server) component. When handling SMB2 lock operations with zero-length locks, improper cleanup during error handling can lead to memory corruption. This affects systems running vulnerable Linux kernel versions with ksmbd enabled.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions with vulnerable ksmbd implementation (check git commits for exact ranges)

Operating Systems: Linux distributions with ksmbd enabled

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if ksmbd (kernel SMB server) is enabled and configured. Many distributions don't enable ksmbd by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, potential privilege escalation to kernel mode, or arbitrary code execution in kernel context.

🟠

Likely Case

System instability, crashes, or denial of service affecting SMB file sharing services.

🟢

If Mitigated

Limited to denial of service if exploit attempts are blocked or system is properly segmented.

🌐 Internet-Facing: MEDIUM - Requires SMB service exposure and specific SMB2 lock operations.

🏢 Internal Only: MEDIUM - Internal attackers with network access to SMB services could exploit this.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to send SMB2 lock requests. Likely requires authenticated access to SMB share.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 410ce35a2ed6d0e114132bba29af49b69880c8c7, 636e021646cf9b52ddfea7c809b018e91f2188cb, 84d2d1641b71dec326e8736a749b7ee76a9599fc, 8573571060ca466cbef2c6f03306b2cc7b883506, a0609097fd10d618aed4864038393dd75131289e

Vendor Advisory: https://git.kernel.org/stable/c/410ce35a2ed6d0e114132bba29af49b69880c8c7

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify ksmbd module loads correctly.

🔧 Temporary Workarounds

Disable ksmbd module

linux

Prevent loading of vulnerable ksmbd kernel module

echo 'blacklist ksmbd' >> /etc/modprobe.d/blacklist-ksmbd.conf
rmmod ksmbd

Restrict SMB access

linux

Limit network access to SMB services using firewall rules

iptables -A INPUT -p tcp --dport 445 -j DROP
iptables -A INPUT -p tcp --dport 139 -j DROP

🧯 If You Can't Patch

Disable ksmbd service if not required
Implement network segmentation to isolate SMB services

🔍 How to Verify

Check if Vulnerable:

Check if ksmbd module is loaded: lsmod | grep ksmbd. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits. Confirm ksmbd module loads without issues.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
ksmbd crash logs in dmesg
SMB connection errors

Network Indicators:

Unusual SMB2 lock requests
Multiple failed SMB connections

SIEM Query:

source="kernel" AND "panic" OR source="ksmbd" AND "error"

📊 Metadata

CVE ID: CVE-2025-21945

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.06% exploit probability (19.6th percentile)

Published: April 1, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21945, you might also want to check these: