Security readout for executives and security teams
Plain-English summary
A race condition in the Linux kernel’s ksmbd SMB file-sharing server can cause it to use a user-session object after that object is freed. A network-connected user with limited privileges may be able to trigger memory corruption, potentially compromising confidentiality, integrity, and availability. Systems not running ksmbd are unlikely to be exposed.
Executive priority
Prioritize affected internet-facing or broadly reachable ksmbd servers for urgent assessment and patching. Treat internal servers as high priority where untrusted or compromised users can authenticate. Systems without ksmbd can be documented as not exposed after configuration and runtime validation.
Technical view
During SMB session logoff, ksmbd may free sess->user while another thread processes a session-setup request that binds another connection to the same session. That thread can subsequently access the freed object. The supplied CVSS 3.1 score is 8.8, with network reachability, low complexity, low privileges, no user interaction, and high impacts.
Likely exposure
Exposure requires a Linux system using ksmbd and network access to its SMB service. The supplied affected-version data includes several kernel branches and releases but is not sufficiently clear to establish precise vulnerable ranges. Distribution backports may also change status, so assess the running vendor kernel rather than relying solely on its version number.
Exploitation context
The source bundle identifies remote network reachability with low privileges and low attack complexity. A public researcher described discovering the issue as a remote zero-day. However, the CVE is not listed as KEV in the bundle, and the supplied evidence does not establish active exploitation or a publicly usable exploit.
Researcher notes
The defect is a concurrent session-lifecycle error involving logoff and session binding. Stable-kernel references document fixes across branches. Precise affected and fixed release boundaries are ambiguous in the supplied version list; confirm commit inclusion or distribution backports. The sources support serious potential impact but do not prove reliable exploitation or exploitation in the wild.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix or backport.
- Consult the Linux distribution’s advisory to map its package versions to the fix.
- Disable ksmbd where SMB file sharing is unnecessary.
- Restrict SMB access to trusted networks and authenticated users until patched.
Validation and detection
- Confirm whether ksmbd is installed, enabled, loaded, or actively serving SMB.
- Identify the running kernel and its distribution package release.
- Verify vendor documentation confirms inclusion of the relevant stable fix or backport.
- Check network controls limit SMB reachability to required trusted clients.
- After updating, confirm the fixed kernel is running, not merely installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37899 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/931dc8a3670f71c45c0b1379ea4e92dafbda1acaCVE reference, Linux
- https://git.kernel.org/stable/c/70ad6455139e26e85f48f95d0e21f351c1909342CVE reference, Linux
- https://git.kernel.org/stable/c/d5ec1d79509b3ee01de02c236f096bc050221b7fCVE reference, Linux
- https://git.kernel.org/stable/c/02d16046cd11a5c037b28c12ffb818c56dd3ef43CVE reference, Linux
- https://git.kernel.org/stable/c/2fc9feff45d92a92cd5f96487655d5be23fb7e2bCVE reference, Linux
- https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/CVE reference, CVE
- https://news.ycombinator.com/item?id=44081338CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.