CVE-2025-38561: Linux Kernel ksmbd smb2_sess_setup Preauth_HashValue Race Condition Remote Code Execution Vulnerability
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix PreauhHashValue race condition
If client send multiple session setup requests to ksmbd, PreauhHashValue race condition could happen. There is no need to free sess->PreauhHashValue at session setup phase. It can be freed together with session at connection termination phase.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the PreauthHashValue field. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38561?
CVE-2025-38561 is considered a medium severity vulnerability due to the potential for race condition exploitation.
How do I fix CVE-2025-38561?
To fix CVE-2025-38561, update the Linux kernel to the latest version where this vulnerability has been addressed.
What systems are affected by CVE-2025-38561?
CVE-2025-38561 affects the Linux kernel, specifically when the ksmbd file server is running.
What is the impact of exploiting CVE-2025-38561?
Exploiting CVE-2025-38561 could lead to a denial-of-service condition due to the Preauh_HashValue race condition.
When was CVE-2025-38561 resolved?
CVE-2025-38561 was resolved with updates in the Linux kernel to fix the related race condition.