CVE-2025-38437

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix potential use-after-free in oplock/lease break ack

If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 0626e6641f6b467447c81dd7678a69c66f7746cf, < e38ec88a2b42c494601b1213816d75f0b54d9bf0; >= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 97c355989928a5f60b228ef5266c1be67a46cdf9; >= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 815f1161d6dbc4c54ccf94b7d3fdeab34b4d7477; >= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 8106adc21a2270c16abf69cd74ccd7c79c6e7acd; >= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 50f930db22365738d9387c974416f38a06e8057e
LinuxLinux5.15

References

Timeline

Published
Jul 25, 2025
Last modified
Jul 30, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-384385.5In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata-CVE-2025-384395.5In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmittinCVE-2025-38449.8The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Authentication Bypass in versions 1.9.1 to 7.5.2. This is due CVE-2025-384404.7In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race between DIM disable and net_dim() There's a race bCVE-2025-384415.5In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_protCVE-2025-384425.5In the Linux kernel, the following vulnerability has been resolved: block: reject bs > ps block devices when THP is disabled If THP is disCVE-2025-384437.8In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path There is a use-after-freCVE-2025-384445.5In the Linux kernel, the following vulnerability has been resolved: raid10: cleanup memleak at raid10_make_request If raid10_read_request CVE-2025-384457.1In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix stack memory use after return in raid1_reshape In the raCVE-2025-384467.1In the Linux kernel, the following vulnerability has been resolved: clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data WhenCVE-2025-384477.1In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix potential out-of-bounds page table access during batched uCVE-2025-384484.7In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Fix race condition in TTY wakeup A race conditi
CVE-2025-38437: High severity, CVSS 7.8 | Vulnix