CVE-2025-22074High· 8.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: ksmbd: fix r_count dec/increment mismatch r_count is only increased when there is an oplock break wait, so r_count inc/decrement are not paired. This can cause r_count…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix r_count dec/increment mismatch
r_count is only increased when there is an oplock break wait, so r_count inc/decrement are not paired. This can cause r_count to become negative, which can lead to a problem where the ksmbd thread does not terminate.
Linux >= 8e6508c7ecb1802909f294827eff38f301d0c937 < 8829849da3f68697b830a5b36047b0d8a50ae3edLinux >= 09aeab68033161cb54f194da93e51a11aee6144b < 4790bcb269e5d6d88200a67c54ae6d627332a3beLinux >= a4261bbc33fbf99b99c80aa3a2c5097611802980 < 457db486203c90e10c3efc87fd45cc7000b1cd36Linux >= f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa < 20378cf48359f39dee0ef9b61470ebe77bd49c0dLinux >= 3aa660c059240e0c795217182cf7df32909dd917 < c2ec33d46b4d1c8085dab5d02e00b21f4f0fb8a9Linux >= 3aa660c059240e0c795217182cf7df32909dd917 < ddb7ea36ba7129c2ed107e2186591128618864e1Linux >= 6.6.84 < 6.6.87Linux >= 6.12.20 < 6.12.23Linux >= 6.13.8 < 6.13.11Linux 6.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses