{"id":"CVE-2025-21967","title":"ksmbd: fix use-after-free in ksmbd_free_work_struct","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_free_work_struct\n\n->interim_entry of ksmbd_work could be deleted after oplock is freed.\nWe don't need to manage it with linked list. …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < ffe0909010b21df8f948d624ad00cf14dd856721","Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3","Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 62746ae3f5414244a96293e3b017be637b641280","Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < eb51f6f59d19b92f6fe84d3873f958495ab32f0a","Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < bb39ed47065455604729404729d9116868638d31","Linux 5.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-04-16T13:14:51.011092Z"},"published":"2025-04-01","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:21:05.006Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21967","references":[{"url":"https://git.kernel.org/stable/c/ffe0909010b21df8f948d624ad00cf14dd856721"},{"url":"https://git.kernel.org/stable/c/fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3"},{"url":"https://git.kernel.org/stable/c/62746ae3f5414244a96293e3b017be637b641280"},{"url":"https://git.kernel.org/stable/c/eb51f6f59d19b92f6fe84d3873f958495ab32f0a"},{"url":"https://git.kernel.org/stable/c/bb39ed47065455604729404729d9116868638d31"}],"tags":["cve.org"],"epss":0.00383,"epssPercentile":0.32616,"ingestedAt":"2026-11-03T15:48:07.703Z","slug":"CVE-2025-21967","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_free_work_struct\n\n->interim_entry of ksmbd_work could be deleted after oplock is freed.\nWe don't need to manage it with linked list. The interim request could be\nimmediately sent whenever a oplock break wait is needed.\n\n## Affected\n\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < ffe0909010b21df8f948d624ad00cf14dd856721`\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3`\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 62746ae3f5414244a96293e3b017be637b641280`\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < eb51f6f59d19b92f6fe84d3873f958495ab32f0a`\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < bb39ed47065455604729404729d9116868638d31`\n- `Linux 5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}