Security readout for executives and security teams
Plain-English summary
A memory-safety flaw in Linux's ksmbd SMB server can let an authenticated network user trigger use-after-free behavior. Successful exploitation could affect confidentiality, integrity, and availability. Risk is concentrated in systems running ksmbd and exposing SMB services; systems not using ksmbd are unlikely to be directly exposed.
Executive priority
Treat this as a high-priority patching issue for internet-facing or broadly reachable ksmbd servers. Inventory exposure promptly and apply supported updates during an accelerated maintenance window. Systems without ksmbd enabled can be deprioritized after configuration and runtime validation.
Technical view
CVE-2025-21967 is a CWE-416 use-after-free in ksmbd_free_work_struct. An interim_entry associated with ksmbd_work could be deleted after its oplock was freed. The kernel fix removes unnecessary linked-list management and sends the interim request immediately when waiting for an oplock break. CVSS 3.1 is 8.8: network reachable, low complexity, low privileges, and no user interaction.
Likely exposure
Prioritize Linux hosts where ksmbd is enabled, SMB is reachable, and untrusted or lower-privileged users can authenticate. The source bundle identifies affected Linux versions but does not provide sufficiently clear range notation for reliable package-level conclusions. Distribution backports may also change exposure, so validate against vendor advisories and kernel build provenance.
Exploitation context
The supplied sources do not establish active exploitation, and this CVE is not identified as being in CISA KEV. The CVSS vector indicates an authenticated, network-based attack with low complexity. No conclusion should be drawn about public exploit availability from this bundle.
Researcher notes
The vulnerable lifecycle involves ksmbd_work interim_entry handling during oplock-break waiting. The upstream resolution removes linked-list handling for that interim request. The bundle provides four stable-kernel commits, suggesting branch-specific fixes. Exact vulnerable version boundaries and distribution package mappings remain unclear and require vendor confirmation.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable stable fix or backport.
- If ksmbd is unnecessary, disable it following distribution guidance.
- Restrict SMB access to trusted networks and authenticated users while patching.
- Review Linux distribution advisories for exact affected and fixed package versions.
Validation and detection
- Determine whether ksmbd is enabled, loaded, or configured to start automatically.
- Confirm whether SMB service ports are reachable from untrusted networks.
- Record the running kernel and distribution package versions on exposed hosts.
- Verify the installed kernel contains the vendor backport or referenced stable fix.
- Retest ksmbd availability and required file-sharing functions after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21967 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3CVE reference, Linux
- https://git.kernel.org/stable/c/62746ae3f5414244a96293e3b017be637b641280CVE reference, Linux
- https://git.kernel.org/stable/c/eb51f6f59d19b92f6fe84d3873f958495ab32f0aCVE reference, Linux
- https://git.kernel.org/stable/c/bb39ed47065455604729404729d9116868638d31CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.