Security readout for executives and security teams
Plain-English summary
A race condition in the Linux kernel SMB server, ksmbd, can let one thread use Kerberos session data after another thread frees it. The supplied rating indicates possible confidentiality, integrity, and availability impact. Exposure depends on whether ksmbd and Kerberos authentication are actually enabled.
Executive priority
Treat confirmed ksmbd-plus-Kerberos deployments as urgent patching candidates, especially when SMB is reachable from untrusted networks. Systems using another SMB implementation or not using ksmbd require verification before prioritization. Current sources do not justify claiming an active attack campaign.
Technical view
During concurrent Kerberos authentication processing, ksmbd may call ksmbd_free_user on sess->user before setting that pointer to NULL. Another thread can dereference the freed object during this interval, causing a use-after-free. The supplied CVSS 3.1 score is 9.8 with network, low-complexity, unauthenticated, no-interaction characteristics.
Likely exposure
Prioritize Linux hosts running the in-kernel ksmbd SMB server with Kerberos authentication. The CVE record lists affected Linux kernel releases including 5.15, 6.1.138, 6.6.90, 6.12.28, 6.14.6, and 6.15. Distribution backports may change exposure, so kernel version alone may be insufficient.
Exploitation context
The supplied record is not in KEV, and the sources provide no evidence of active exploitation or a public exploit. The CVSS vector describes network-reachable, unauthenticated potential, but it does not establish practical exploit reliability. Successful triggering appears dependent on concurrent session activity reaching the race window.
Researcher notes
The defect is a narrow concurrency window between freeing sess->user and clearing the pointer. The record supplies multiple stable-tree fixes but no CWE classification, crash signature, proof of concept, or demonstrated exploitation outcome. Assess distribution-specific backports and configuration before drawing exposure conclusions.
Mitigation direction
- Apply a supported vendor kernel update that incorporates the referenced ksmbd fix.
- Confirm distribution advisories because vendors may backport fixes without changing upstream version numbers.
- If patching is delayed, consult vendor guidance for supported temporary exposure-reduction measures.
- Prioritize internet-facing or broadly reachable SMB servers using ksmbd and Kerberos.
Validation and detection
- Inventory systems where ksmbd is installed, loaded, enabled, or serving SMB traffic.
- Determine whether affected ksmbd deployments use Kerberos authentication.
- Compare running kernel packages with current distribution security advisories for CVE-2025-37924.
- Verify package changelogs or source history include the applicable referenced stable-kernel fix.
- Retest service availability and Kerberos authentication after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37924 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e34a33d5d7e87399af0a138bb32f6a3e95dd83d2CVE reference, Linux
- https://git.kernel.org/stable/c/b447463562238428503cfba1c913261047772f90CVE reference, Linux
- https://git.kernel.org/stable/c/e18c616718018dfc440e4a2d2b94e28fe91b1861CVE reference, Linux
- https://git.kernel.org/stable/c/28c756738af44a404a91b77830d017bb0c525890CVE reference, Linux
- https://git.kernel.org/stable/c/e86e9134e1d1c90a960dd57f59ce574d27b9a124CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.