Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2025-68263

ksmbd: ipc: fix use-after-free in ipc_msg_send_request

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock. Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event(): BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd] Write of size 12 at addr ffff888198ee6e20 by task pool/109349 ... Freed by task: kvfree ipc_msg_send_request [ksmbd] ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd] Fix by: - Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table. - Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock. - Returning NULL in the error path, preserving the original API semantics. This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0626e6641f6b467447c81dd7678a69c66f7746cf to < de85fb58f9967ba024bb08e0041613d37b57b4d1affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to < 708a620b471a14466f1f52c90bf3f65ebdb31460affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to < 5ac763713a1ef8f9a8bda1dbd81f0318d67baa4eaffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to < 759c8c30cfa8706c518e56f67971b1f0932f4b9baffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to < 8229c6ca50cea701e25a7ee25f48441b582ec5faaffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to < 1fab1fa091f5aa97265648b53ea031deedd26235affected

Linux Linux

Default version status: affected

  • 5.15affected
  • 0 to < 5.15unaffected
  • 6.1.160 to ≤ 6.1.*unaffected
  • 6.6.120 to ≤ 6.6.*unaffected
  • 6.12.62 to ≤ 6.12.*unaffected
  • 6.17.12 to ≤ 6.17.*unaffected
  • 6.18.1 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References