{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38325","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:24.004Z","datePublished":"2025-07-10T08:14:59.544Z","dateUpdated":"2026-08-05T12:01:09.621Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:01:09.621Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add free_transport ops in ksmbd connection\n\nfree_transport function for tcp connection can be called from smbdirect.\nIt will cause kernel oops. This patch add free_transport ops in ksmbd\nconnection, and add each free_transports for tcp and smbdirect."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable teardown path belongs to ksmbd's in-kernel SMB Direct transport, whose RDMA CM listener accepts connections from remote peers on port 445 (InfiniBand) / 5445 (iWARP), and is reachable over routable IP via iWARP/RoCEv2 or software providers (siw/rxe). No local access is needed — a remote peer triggers it by establishing and dropping an SMB Direct connection.\nAC:L - The type confusion is deterministic — every SMB Direct connection teardown funnels through ksmbd_conn_free() → ksmbd_free_transport() and fabricates a socket pointer from the status/full_packet_received bytes, with no race or memory-layout precondition. The premature-free variant simply requires holding an oplock/lease at disconnect time, which the attacker fully controls.\nPR:N - Connection setup and teardown happen entirely before SMB2 SESSION_SETUP: the error path in smb_direct_handle_connect_request() and the normal ksmbd_conn_handler_loop() exit both call free_transport() with no credentials verified. An unauthenticated peer that connects and disconnects triggers the confused free.\nUI:N - The attacker drives the entire sequence by opening and closing an SMB Direct connection; no action by any local user or administrator is required beyond ksmbd already serving SMB Direct.\nS:U - The corruption is confined to kernel memory managed by the ksmbd server within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The type confusion plus the unconditional kfree(t) in the RDMA free_transport() leave conn->transport dangling and double-free the slab object, giving a use-after-free on a large kmalloc allocation that an attacker can reclaim and read back through ksmbd_conn_write()/rdma_read paths, which is leverageable for arbitrary kernel memory disclosure.\nI:H - This is a genuine type confusion combined with a double free and a use-after-free whose reuse ends in an indirect call through freed memory (conn->transport->ops->writev in __smb2_lease_break_noti()), a direct control-flow hijack primitive once the freed object is groomed.\nA:H - Every SMB Direct teardown calls sock_release() on a fabricated pointer built from the status enum, producing a guaranteed kernel oops that kills the ksmbd kthread and leaks its RDMA resources, and panics outright on panic_on_oops configurations common in appliances and embedded deployments."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/connection.c","fs/smb/server/connection.h","fs/smb/server/transport_rdma.c","fs/smb/server/transport_tcp.c"],"versions":[{"version":"1da8bd9a10ecd718692732294d15fd801c0eabb5","lessThan":"52f5a52dc17a4a7b4363ac03fe2c4ef26f020dc6","status":"affected","versionType":"git"},{"version":"1aec4d14cf81b7b3e7b69eb1cfa94144eed7138e","lessThan":"3890da762a66191c440b0bd6e3ee45501edbb0c1","status":"affected","versionType":"git"},{"version":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","lessThan":"3f3aae77280aad9f5acc6709c596148966f765c7","status":"affected","versionType":"git"},{"version":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","lessThan":"a89f5fae998bdc4d0505306f93844c9ae059d50c","status":"affected","versionType":"git"},{"version":"e59796fc80603bcd8569d4d2e10b213c1918edb4","status":"affected","versionType":"git"},{"version":"6.12.26","lessThan":"6.12.35","status":"affected","versionType":"semver"},{"version":"6.14.4","lessThan":"6.15","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/connection.c","fs/smb/server/connection.h","fs/smb/server/transport_rdma.c","fs/smb/server/transport_tcp.c"],"versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","status":"unaffected","versionType":"semver"},{"version":"6.12.35","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.15.4","lessThanOrEqual":"6.15.*","status":"unaffected","versionType":"semver"},{"version":"6.16","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.26","versionEndExcluding":"6.12.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.15.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14.4"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/52f5a52dc17a4a7b4363ac03fe2c4ef26f020dc6"},{"url":"https://git.kernel.org/stable/c/3890da762a66191c440b0bd6e3ee45501edbb0c1"},{"url":"https://git.kernel.org/stable/c/3f3aae77280aad9f5acc6709c596148966f765c7"},{"url":"https://git.kernel.org/stable/c/a89f5fae998bdc4d0505306f93844c9ae059d50c"}],"title":"ksmbd: add free_transport ops in ksmbd connection","x_generator":{"engine":"bippy-1.2.0"}}}}