Summary: A high-severity use-after-free vulnerability (CVE-2025-37899) has been discovered in the ksmbd component of the Linux kernel, which implements the SMB3 protocol for file sharing.

OEM	Linux
Severity	High
CVSS Score	N/A
CVEs	CVE-2025-37899
Actively Exploited	No
Exploited in Wild	No
Advisory Version	1.0

Overview

The vulnerability, confirmed on May 20, 2025 which was uncovered through AI-assisted code analysis using OpenAI’s o3 model. It affects multiple versions of the Linux kernel and may lead to arbitrary code execution with kernel privileges. As of now, no official fix is available, but Linux distributions including SUSE team are actively working on patches.

Vulnerability Name	CVE ID	Product Affected	Severity
​ksmbd use-after-free vulnerability	CVE-2025-37899	Linux kernel	High

Technical Summary

The vulnerability lies in the ksmbd kernel server component responsible for SMB3 protocol handling.

A use-after-free bug occurs when one thread processes a logoff command and frees the sess->user object, while another thread bound to the same session attempts to access the same object simultaneously. This results in a race condition that can lead to memory corruption and potentially enable attackers to execute arbitrary code with kernel privileges.

CVE ID	System Affected	Vulnerability Details	Impact
CVE-2025-37899	Linux kernel (ksmbd)	A race condition during handling of SMB2 LOGOFF commands. sess->user is freed in one thread while still being accessed in another, leading to a classic use-after-free vulnerability. The absence of synchronization around sess->user allows attackers to exploit the freed memory during concurrent SMB operations.	Kernel memory corruption, privilege escalation, remote code execution

Remediation:

• Fix status: As of now, an official fix has not been released. Linux distributions, including SUSE, are actively developing and testing patches.

General Recommendations

• Monitor your distribution’s security advisories and apply patches as soon as they are available.
• Consider disabling or restricting ksmbd (in-kernel SMB3 server) if not explicitly required.
• Use firewall rules to restrict access to SMB services to trusted networks.
• Employ kernel hardening options (e.g. memory protections, SELinux/AppArmor policies).
• Audit SMB traffic for signs of abnormal session setup and teardown behavior.

Conclusion:
CVE-2025-37899 highlights the increasing role of AI in modern vulnerability discovery and the complex nature of concurrency bugs in kernel components. While no fix is yet available, administrators should apply defense-in-depth strategies and watch for updates from their Linux vendors.

The discovery underscores the importance of rigorous code audits, especially in components exposed to network traffic and multithreaded processing.

References:

• https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
• https://cybersecuritynews.com/linux-kernel-smb-0-day-vulnerability/