CVE-2025-37778: ksmbd: Fix dangling pointer in krb_authenticate
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: Fix dangling pointer in krbauthenticate
krbauthenticate frees sess->user and does not set the pointer to NULL. It calls ksmbdkrb5authenticate to reinitialise sess->user but that function may return without doing so. If that happens then smb2sesssetup, which calls krbauthenticate, will be accessing free'd memory when it later uses sess->user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37778?
CVE-2025-37778 has been classified with a medium severity level due to potential exposure to denial of service.
How do I fix CVE-2025-37778?
To fix CVE-2025-37778, ensure that you update the Linux kernel to a version where the vulnerability has been patched.
What impact does CVE-2025-37778 have on systems?
CVE-2025-37778 can lead to memory corruption, which may be exploitable for denial of service attacks.
Which versions of the Linux kernel are affected by CVE-2025-37778?
CVE-2025-37778 affects specific versions of the Linux kernel prior to the release where the vulnerability was fixed.
Who is affected by CVE-2025-37778?
Any organization or individual using vulnerable versions of the Linux kernel is at risk from CVE-2025-37778.