CVE-2025-68817

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68817", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:30:51.048Z", "datePublished": "2026-01-13T15:29:21.210Z", "dateUpdated": "2026-08-05T12:11:44.783Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:11:44.783Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency\n\nUnder high concurrency, A tree-connection object (tcon) is freed on\na disconnect path while another path still holds a reference and later\nexecutes *_put()/write on it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - ksmbd processes remotely supplied SMB2/3 requests over TCP port 445, with the request path reaching smb2_tree_disconnect and ksmbd_tree_connect_put in kernel context.\nAC:L - A remote client can control both sides by issuing concurrent tree-scoped requests and SMB2_TREE_DISCONNECT against its own tree connection. ksmbd permits thousands of in-flight work items, allowing repeated race attempts without conditions outside attacker control.\nPR:N - The path requires a valid SMB session and tree ID, but ksmbd supports public guest shares and skips password verification for guest accounts. An attacker can therefore establish the required session and tree without credentials in a reasonable deployment.\nUI:N - Once the SMB server and share are available, the attacker triggers the race entirely through network requests without victim action.\nS:U - The UAF corrupts the ksmbd host kernel within the same security authority; it does not inherently cross a VM, IOMMU, or other separate security boundary.\nC:H - The final reference release accesses the freed tcon wait-queue list, which can operate on attacker-influenced contents after heap reclamation. This kernel UAF can plausibly provide arbitrary memory disclosure rather than only a bounded leak.\nI:H - wake_up can lock and traverse the reclaimed wait queue, causing writes and an indirect function call through stale contents. Heap spraying can therefore support arbitrary write or kernel control-flow hijacking.\nA:H - Invalid wait-queue pointers, corrupted lock state, or a stale indirect call can cause a kernel oops or panic. The remotely controlled race can be attempted repeatedly."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/mgmt/tree_connect.c", "fs/smb/server/mgmt/tree_connect.h", "fs/smb/server/smb2pdu.c"], "versions": [{"version": "dd45db4d9bbc8f122a9b4db5ce94ae29fcf03d3c", "lessThan": "446beed646b2e426dd53d27358365f8678e1dd01", "status": "affected", "versionType": "git"}, {"version": "7b58ee8d0b91359554cf219cd4f33872ea2afd66", "lessThan": "d092de8a26c952379ded8e6b0bda31d89befac1a", "status": "affected", "versionType": "git"}, {"version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e", "lessThan": "d64977495e44855f2b28d8ce56107c963a7a50e4", "status": "affected", "versionType": "git"}, {"version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e", "lessThan": "21a3d01fc6db5129f81edb0ab7cb94fd758bcbea", "status": "affected", "versionType": "git"}, {"version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e", "lessThan": "063cbbc6f595ea36ad146e1b7d2af820894beb21", "status": "affected", "versionType": "git"}, {"version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e", "lessThan": "b39a1833cc4a2755b02603eec3a71a85e9dff926", "status": "affected", "versionType": "git"}, {"version": "5.15.145", "lessThan": "5.15.199", "status": "affected", "versionType": "semver"}, {"version": "6.1.71", "lessThan": "6.1.160", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/mgmt/tree_connect.c", "fs/smb/server/mgmt/tree_connect.h", "fs/smb/server/smb2pdu.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.199", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.160", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.120", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.64", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.3", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.145", "versionEndExcluding": "5.15.199"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.71", "versionEndExcluding": "6.1.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/446beed646b2e426dd53d27358365f8678e1dd01"}, {"url": "https://git.kernel.org/stable/c/d092de8a26c952379ded8e6b0bda31d89befac1a"}, {"url": "https://git.kernel.org/stable/c/d64977495e44855f2b28d8ce56107c963a7a50e4"}, {"url": "https://git.kernel.org/stable/c/21a3d01fc6db5129f81edb0ab7cb94fd758bcbea"}, {"url": "https://git.kernel.org/stable/c/063cbbc6f595ea36ad146e1b7d2af820894beb21"}, {"url": "https://git.kernel.org/stable/c/b39a1833cc4a2755b02603eec3a71a85e9dff926"}], "title": "ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/mgmt/tree_connect.c", "fs/smb/server/mgmt/tree_connect.h", "fs/smb/server/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "446beed646b2e426dd53d27358365f8678e1dd01", "status": "affected", "version": "dd45db4d9bbc8f122a9b4db5ce94ae29fcf03d3c", "versionType": "git"}, {"lessThan": "d092de8a26c952379ded8e6b0bda31d89befac1a", "status": "affected", "version": "7b58ee8d0b91359554cf219cd4f33872ea2afd66", "versionType": "git"}, {"lessThan": "d64977495e44855f2b28d8ce56107c963a7a50e4", "status": "affected", "version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e", "versionType": "git"}, {"lessThan": "21a3d01fc6db5129f81edb0ab7cb94fd758bcbea", "status": "affected", "version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e", "versionType": "git"}, {"lessThan": "063cbbc6f595ea36ad146e1b7d2af820894beb21", "status": "affected", "version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e", "versionType": "git"}, {"lessThan": "b39a1833cc4a2755b02603eec3a71a85e9dff926", "status": "affected", "version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e", "versionType": "git"}, {"lessThan": "5.15.199", "status": "affected", "version": "5.15.145", "versionType": "semver"}, {"lessThan": "6.1.160", "status": "affected", "version": "6.1.71", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/mgmt/tree_connect.c", "fs/smb/server/mgmt/tree_connect.h", "fs/smb/server/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.199", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.160", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.120", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.64", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1261CF8-0493-4918-93E6-5CC197F7F5E8", "versionEndExcluding": "5.15.199", "versionStartIncluding": "5.15.145", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9295139C-2E02-401E-8245-07E821E9CCF0", "versionEndExcluding": "6.1.160", "versionStartIncluding": "6.1.71", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5F84D90-D922-47D3-B042-99569840DD8F", "versionEndExcluding": "6.6.120", "versionStartIncluding": "6.6.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "32BF4A52-377C-44ED-B5E6-7EA5D896E98B", "versionEndExcluding": "6.12.64", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DC484D8-FB4F-4112-900F-AE333B6FE7A7", "versionEndExcluding": "6.18.3", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*", "matchCriteriaId": "E346B162-D566-4E62-ABDE-ECBFB21B8BFD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*", "matchCriteriaId": "E7C78D0A-C4A2-4D41-B726-8979E33AD0F9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc6:*:*:*:*:*:*", "matchCriteriaId": "E114E9DD-F7E1-40CC-AAD5-F14E586CB2E6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc7:*:*:*:*:*:*", "matchCriteriaId": "DC5BD782-474C-4A68-AED7-6EC818FF89AE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency\n\nUnder high concurrency, A tree-connection object (tcon) is freed on\na disconnect path while another path still holds a reference and later\nexecutes *_put()/write on it."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en ksmbd_tree_connect_put bajo concurrencia\n\nBajo alta concurrencia, un objeto de conexi\u00f3n de \u00e1rbol (tcon) es liberado en una ruta de desconexi\u00f3n mientras otra ruta a\u00fan mantiene una referencia y posteriormente ejecuta *_put()/write sobre \u00e9l."}], "id": "CVE-2025-68817", "lastModified": "2026-07-30T06:24:47.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-01-13T16:16:03.983", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/063cbbc6f595ea36ad146e1b7d2af820894beb21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/21a3d01fc6db5129f81edb0ab7cb94fd758bcbea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/446beed646b2e426dd53d27358365f8678e1dd01"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b39a1833cc4a2755b02603eec3a71a85e9dff926"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d092de8a26c952379ded8e6b0bda31d89befac1a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d64977495e44855f2b28d8ce56107c963a7a50e4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency", "id": "2429097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429097"}, "csaw": false, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency\nUnder high concurrency, A tree-connection object (tcon) is freed on\na disconnect path while another path still holds a reference and later\nexecutes *_put()/write on it."], "name": "CVE-2025-68817", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68817\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68817\nhttps://lore.kernel.org/linux-cve-announce/2026011313-CVE-2025-68817-03ab@gregkh/T"]}

{}