{"id":"CVE-2025-37952","title":"ksmbd: Fix UAF in __close_file_table_ids","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix UAF in __close_file_table_ids\n\nA use-after-free is possible if one thread destroys the file\nvia __ksmbd_close_fd while another thread holds a reference to\nit…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 21100812657965dd95bc305f6076f62012f34cf4","Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < fec1f9e9a650e8e7011330a085c77e7bf2a08ea9","Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 9e9841e232b51171ddf3bc4ee517d5d28dc8cad6","Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 16727e442568a46d9cca69fe2595896de86e120d","Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 36991c1ccde2d5a521577c448ffe07fcccfe104d","Linux 5.15"],"published":"2025-05-20","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:21:27.465Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-37952","references":[{"url":"https://git.kernel.org/stable/c/21100812657965dd95bc305f6076f62012f34cf4"},{"url":"https://git.kernel.org/stable/c/fec1f9e9a650e8e7011330a085c77e7bf2a08ea9"},{"url":"https://git.kernel.org/stable/c/9e9841e232b51171ddf3bc4ee517d5d28dc8cad6"},{"url":"https://git.kernel.org/stable/c/16727e442568a46d9cca69fe2595896de86e120d"},{"url":"https://git.kernel.org/stable/c/36991c1ccde2d5a521577c448ffe07fcccfe104d"}],"tags":["cve.org"],"epss":0.00372,"epssPercentile":0.31385,"ingestedAt":"2026-11-03T16:49:26.499Z","slug":"CVE-2025-37952","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix UAF in __close_file_table_ids\n\nA use-after-free is possible if one thread destroys the file\nvia __ksmbd_close_fd while another thread holds a reference to\nit. The existing checks on fp->refcount are not sufficient to\nprevent this.\n\nThe fix takes ft->lock around the section which removes the\nfile from the file table. This prevents two threads acquiring the\nsame file pointer via __close_file_table_ids, as well as the other\nfunctions which retrieve a file from the IDR and which already use\nthis same lock.\n\n## Affected\n\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 21100812657965dd95bc305f6076f62012f34cf4`\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < fec1f9e9a650e8e7011330a085c77e7bf2a08ea9`\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 9e9841e232b51171ddf3bc4ee517d5d28dc8cad6`\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 16727e442568a46d9cca69fe2595896de86e120d`\n- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 36991c1ccde2d5a521577c448ffe07fcccfe104d`\n- `Linux 5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}