GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38561 (GCVE-0-2025-38561)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:02 – Updated: 2026-08-05 12:02
VLAI
Title
ksmbd: fix Preauh_HashValue race condition
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Preauh_HashValue race condition If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashValue at session setup phase. It can be freed together with session at connection termination phase.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-26 03:55 UTC
CWE
  • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < fbf5c0845ed15122a770bca9be1d9b60b470d3aa (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < b69fd87076daa66f3d186bd421a7b0ee0cb45829 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < edeecc7871e8fc0878d53ce286c75040a0e38f6c (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 7d7c0c5304c88bcbd7a85e9bcd61d27e998ba5fc (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 6613887da1d18dd2ecfd6c6148a873c4d903ebdc (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.148 , ≤ 6.1.* (semver)
Unaffected: 6.6.102 , ≤ 6.6.* (semver)
Unaffected: 6.12.42 , ≤ 6.12.* (semver)
Unaffected: 6.15.10 , ≤ 6.15.* (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-38561",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-26T03:55:12.286714Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:48:28.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:50.588Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fbf5c0845ed15122a770bca9be1d9b60b470d3aa",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "b69fd87076daa66f3d186bd421a7b0ee0cb45829",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "edeecc7871e8fc0878d53ce286c75040a0e38f6c",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "7d7c0c5304c88bcbd7a85e9bcd61d27e998ba5fc",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "6613887da1d18dd2ecfd6c6148a873c4d903ebdc",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix Preauh_HashValue race condition\n\nIf client send multiple session setup requests to ksmbd,\nPreauh_HashValue race condition could happen.\nThere is no need to free sess-\u003ePreauh_HashValue at session setup phase.\nIt can be freed together with session at connection termination phase."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445, and the entire path is driven by remote SMB2 SESSION_SETUP PDUs parsed straight off the socket. Internet- and LAN-facing NAS, container, and file-server deployments are directly exposed.\nAC:L - The attacker controls both sides of the race completely \u2014 how many SESSION_SETUP PDUs to pipeline, across how many TCP connections, whether to use multichannel binding to bypass the per-connection mutex entirely, and when to drop the socket to race connection teardown. ksmbd\u0027s non-ordered workqueue guarantees parallel processing, and failed attempts cost only a reconnect.\nPR:N - SESSION_SETUP is the authentication handshake itself; the buffer is allocated, hashed, and read on the response path before any credential is verified, and the NtLmNegotiate racer is fully pre-authentication. The guest branch of ntlm_authenticate() skips the NTLM blob check entirely, reaching the vulnerable kfree() with no credentials on the common guest-mapped share configuration.\nUI:N - Exploitation requires only that the attacker connect to the SMB port and send session setup requests. No action by any local user or administrator is needed.\nS:U - The double free and use-after-free corrupt kernel heap memory within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed 64-byte chunk is read back via sha512_update() and, decisively, serves as the KDF context for the SMB 3.1.1 signing and encryption keys \u2014 reclaiming it with chosen content yields attacker-known session keys and decryption of other clients\u0027 traffic. The double free of a general-purpose kmalloc-64 object is also a standard route to a full arbitrary-read primitive.\nI:H - This is a double free of a kmalloc-64 object plus a 64-byte out-of-lifetime write (sha512_final into the freed buffer) that clobbers whatever victim object reclaimed the slot, giving the classic heap-grooming path to arbitrary write and control-flow hijack. It additionally enables forging signed SMB messages by controlling the signing-key derivation context.\nA:H - The double free corrupts the SLUB freelist and the use-after-free write smashes reclaimed objects, both of which panic the kernel. The racing NULL store also reaches ksmbd_gen_smb311_encryptionkey()/ksmbd_gen_smb311_signingkey(), which dereference sess-\u003ePreauth_HashValue with no NULL check, for a trivially repeatable remote oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:55.275Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fbf5c0845ed15122a770bca9be1d9b60b470d3aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b69fd87076daa66f3d186bd421a7b0ee0cb45829"
        },
        {
          "url": "https://git.kernel.org/stable/c/edeecc7871e8fc0878d53ce286c75040a0e38f6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d7c0c5304c88bcbd7a85e9bcd61d27e998ba5fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6613887da1d18dd2ecfd6c6148a873c4d903ebdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6"
        },
        {
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-916/"
        }
      ],
      "title": "ksmbd: fix Preauh_HashValue race condition",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38561",
    "datePublished": "2025-08-19T17:02:38.719Z",
    "dateReserved": "2025-04-16T04:51:24.025Z",
    "dateUpdated": "2026-08-05T12:02:55.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38561",
      "date": "2026-09-16",
      "epss": "0.00432",
      "percentile": "0.36795"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T04:18:23.000Z",
      "cve": "CVE-2025-38561",
      "id": "msrc_CVE-2025-38561",
      "initial_release_date": "2025-08-02T00:00:00.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: fix Preauh_HashValue race condition",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38561.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38561\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:32.503\",\"lastModified\":\"2026-07-30T06:23:26.157\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix Preauh_HashValue race condition\\n\\nIf client send multiple session setup requests to ksmbd,\\nPreauh_HashValue race condition could happen.\\nThere is no need to free sess-\u003ePreauh_HashValue at session setup phase.\\nIt can be freed together with session at connection termination phase.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: se corrige la condici\u00f3n de ejecuci\u00f3n Preauh_HashValue. Si el cliente env\u00eda varias solicitudes de configuraci\u00f3n de sesi\u00f3n a ksmbd, podr\u00eda producirse la condici\u00f3n de ejecuci\u00f3n Preauh_HashValue. No es necesario liberar sess-\u0026gt;Preauh_HashValue durante la configuraci\u00f3n de la sesi\u00f3n. Se puede liberar junto con la sesi\u00f3n al finalizar la conexi\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"fbf5c0845ed15122a770bca9be1d9b60b470d3aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"b69fd87076daa66f3d186bd421a7b0ee0cb45829\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"edeecc7871e8fc0878d53ce286c75040a0e38f6c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"7d7c0c5304c88bcbd7a85e9bcd61d27e998ba5fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"6613887da1d18dd2ecfd6c6148a873c4d903ebdc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.148\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.102\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.42\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.10\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.1\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-09-26T03:55:12.286714Z\",\"id\":\"CVE-2025-38561\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"6.1.148\",\"matchCriteriaId\":\"7CA681DB-2710-49E2-AB20-53540484CB00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.102\",\"matchCriteriaId\":\"DD6EDB96-08AC-49D8-A1A9-4D2140C49BC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.42\",\"matchCriteriaId\":\"EA7AA5E6-4376-4A85-A021-6ACC5FF801C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.10\",\"matchCriteriaId\":\"5890C690-B295-40C2-9121-FF5F987E5142\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.1\",\"matchCriteriaId\":\"58182352-D7DF-4CC9-841E-03C1D852C3FB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6613887da1d18dd2ecfd6c6148a873c4d903ebdc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d7c0c5304c88bcbd7a85e9bcd61d27e998ba5fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b69fd87076daa66f3d186bd421a7b0ee0cb45829\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/edeecc7871e8fc0878d53ce286c75040a0e38f6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fbf5c0845ed15122a770bca9be1d9b60b470d3aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-25-916/\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:16:11+00:00",
      "cve": "CVE-2025-38561",
      "id": "CVE-2025-38561",
      "initial_release_date": "2025-08-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix Preauh_HashValue race condition",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38561.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-28T17:00:24Z",
      "cve": "CVE-2025-38561",
      "id": "CVE-2025-38561",
      "initial_release_date": "2025-08-19T23:23:55Z",
      "product_status:known_not_affected": "580",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38561",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38561.json",
      "version": "8"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T17:39:50.588Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38561\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-26T03:55:12.286714Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-17T12:16:45.598Z\"}}], \"cna\": {\"title\": \"ksmbd: fix Preauh_HashValue race condition\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"fbf5c0845ed15122a770bca9be1d9b60b470d3aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"b69fd87076daa66f3d186bd421a7b0ee0cb45829\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"edeecc7871e8fc0878d53ce286c75040a0e38f6c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"7d7c0c5304c88bcbd7a85e9bcd61d27e998ba5fc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"6613887da1d18dd2ecfd6c6148a873c4d903ebdc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/smb/server/smb2pdu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.148\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.102\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.42\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/server/smb2pdu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fbf5c0845ed15122a770bca9be1d9b60b470d3aa\"}, {\"url\": \"https://git.kernel.org/stable/c/b69fd87076daa66f3d186bd421a7b0ee0cb45829\"}, {\"url\": \"https://git.kernel.org/stable/c/edeecc7871e8fc0878d53ce286c75040a0e38f6c\"}, {\"url\": \"https://git.kernel.org/stable/c/7d7c0c5304c88bcbd7a85e9bcd61d27e998ba5fc\"}, {\"url\": \"https://git.kernel.org/stable/c/6613887da1d18dd2ecfd6c6148a873c4d903ebdc\"}, {\"url\": \"https://git.kernel.org/stable/c/44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6\"}, {\"url\": \"https://www.zerodayinitiative.com/advisories/ZDI-25-916/\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix Preauh_HashValue race condition\\n\\nIf client send multiple session setup requests to ksmbd,\\nPreauh_HashValue race condition could happen.\\nThere is no need to free sess-\u003ePreauh_HashValue at session setup phase.\\nIt can be freed together with session at connection termination phase.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.148\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.102\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.42\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15.10\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.1\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-07-30T05:55:14.774Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-38561\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T05:55:14.774Z\", \"dateReserved\": \"2025-04-16T04:51:24.025Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-08-19T17:02:38.719Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.