---
id: CVE-2025-21967
title: 'ksmbd: fix use-after-free in ksmbd_free_work_struct'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: fix use-after-free in ksmbd_free_work_struct

  ->interim_entry of ksmbd_work could be deleted after oplock is freed.
  We don't need to manage it with linked list. …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    ffe0909010b21df8f948d624ad00cf14dd856721
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    62746ae3f5414244a96293e3b017be637b641280
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    eb51f6f59d19b92f6fe84d3873f958495ab32f0a
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    bb39ed47065455604729404729d9116868638d31
  - Linux 5.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-04-16T13:14:51.011092Z'
published: '2025-04-01'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:21:05.006Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21967'
references:
  - url: 'https://git.kernel.org/stable/c/ffe0909010b21df8f948d624ad00cf14dd856721'
  - url: 'https://git.kernel.org/stable/c/fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3'
  - url: 'https://git.kernel.org/stable/c/62746ae3f5414244a96293e3b017be637b641280'
  - url: 'https://git.kernel.org/stable/c/eb51f6f59d19b92f6fe84d3873f958495ab32f0a'
  - url: 'https://git.kernel.org/stable/c/bb39ed47065455604729404729d9116868638d31'
tags:
  - cve.org
epss: 0.00383
epssPercentile: 0.32616
ingestedAt: '2026-11-03T15:48:07.703Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in ksmbd_free_work_struct

->interim_entry of ksmbd_work could be deleted after oplock is freed.
We don't need to manage it with linked list. The interim request could be
immediately sent whenever a oplock break wait is needed.

## Affected

- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < ffe0909010b21df8f948d624ad00cf14dd856721`
- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3`
- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 62746ae3f5414244a96293e3b017be637b641280`
- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < eb51f6f59d19b92f6fe84d3873f958495ab32f0a`
- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < bb39ed47065455604729404729d9116868638d31`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.