---
id: CVE-2025-37952
title: 'ksmbd: Fix UAF in __close_file_table_ids'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: Fix UAF in __close_file_table_ids

  A use-after-free is possible if one thread destroys the file
  via __ksmbd_close_fd while another thread holds a reference to
  it…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    21100812657965dd95bc305f6076f62012f34cf4
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    fec1f9e9a650e8e7011330a085c77e7bf2a08ea9
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    9e9841e232b51171ddf3bc4ee517d5d28dc8cad6
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    16727e442568a46d9cca69fe2595896de86e120d
  - >-
    Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf <
    36991c1ccde2d5a521577c448ffe07fcccfe104d
  - Linux 5.15
published: '2025-05-20'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:21:27.465Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-37952'
references:
  - url: 'https://git.kernel.org/stable/c/21100812657965dd95bc305f6076f62012f34cf4'
  - url: 'https://git.kernel.org/stable/c/fec1f9e9a650e8e7011330a085c77e7bf2a08ea9'
  - url: 'https://git.kernel.org/stable/c/9e9841e232b51171ddf3bc4ee517d5d28dc8cad6'
  - url: 'https://git.kernel.org/stable/c/16727e442568a46d9cca69fe2595896de86e120d'
  - url: 'https://git.kernel.org/stable/c/36991c1ccde2d5a521577c448ffe07fcccfe104d'
tags:
  - cve.org
epss: 0.00372
epssPercentile: 0.31385
ingestedAt: '2026-11-03T16:49:26.499Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: Fix UAF in __close_file_table_ids

A use-after-free is possible if one thread destroys the file
via __ksmbd_close_fd while another thread holds a reference to
it. The existing checks on fp->refcount are not sufficient to
prevent this.

The fix takes ft->lock around the section which removes the
file from the file table. This prevents two threads acquiring the
same file pointer via __close_file_table_ids, as well as the other
functions which retrieve a file from the IDR and which already use
this same lock.

## Affected

- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 21100812657965dd95bc305f6076f62012f34cf4`
- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < fec1f9e9a650e8e7011330a085c77e7bf2a08ea9`
- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 9e9841e232b51171ddf3bc4ee517d5d28dc8cad6`
- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 16727e442568a46d9cca69fe2595896de86e120d`
- `Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 36991c1ccde2d5a521577c448ffe07fcccfe104d`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.