CVE-2025-37926

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in ksmbd_session_rpc_open

A UAF issue can occur due to a race condition between ksmbd_session_rpc_open() and __session_rpc_close(). Add rpc_lock to the session to protect it.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 0626e6641f6b467447c81dd7678a69c66f7746cf, < a4348710a7267705b75692dc1a000920481d1d92; >= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 1067361a1cc6ad9cdf7acfc47f90012b72ad1502; >= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 8fb3b6c85b7e3127161623586b62abcc366caa20; >= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 6323fec65fe54b365961fed260dd579191e46121; >= 0626e6641f6b467447c81dd7678a69c66f7746cf, < a1f46c99d9ea411f9bf30025b912d881d36fc709
LinuxLinux5.15

References

Timeline

Published
May 20, 2025
Last modified
Jul 30, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-379277.8In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid There iCVE-2025-379287.8In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as belowCVE-2025-379295.5In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays CommitCVE-2025-37934.2The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly valCVE-2025-379305.5In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() Nouveau is moCVE-2025-379315.5In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machiCVE-2025-379325.5In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deCVE-2025-379335.5In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Fix host hang issue during device reboot When the host loseCVE-2025-379347.8In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_dirCVE-2025-379355.5In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM If the mtk_polCVE-2025-379365.5In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's valuCVE-2025-379375.5In the Linux kernel, the following vulnerability has been resolved: objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() I
CVE-2025-37926: High severity, CVSS 7.8 | Vulnix