CVE-2025-38575: ksmbd: use aead_request_free to match aead_request_alloc
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: use aeadrequestfree to match aeadrequestalloc
Use aeadrequestfree() instead of kfree() to properly free memory allocated by aeadrequestalloc(). This ensures sensitive crypto data is zeroed before being freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In ksmbd, replace kfree() with aead_request_free() when freeing memory allocated by aead_request_alloc(), so sensitive cryptographic data is zeroed before release.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38575?
CVE-2025-38575 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38575?
To fix CVE-2025-38575, ensure you update your Linux kernel to a version that incorporates the fix for this vulnerability.
What does CVE-2025-38575 affect?
CVE-2025-38575 affects the Linux kernel specifically in its ksmbd implementation.
What is the impact of CVE-2025-38575?
The impact of CVE-2025-38575 is that it may lead to improper handling of sensitive crypto data if memory is not correctly freed.
Is CVE-2025-38575 a publicly disclosed vulnerability?
Yes, CVE-2025-38575 is a publicly disclosed vulnerability affecting the Linux kernel.