HIGH
ksmbd TreeConnect UAF
CVE-2025-68817
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it.
02KernelScan AI Analysis
Risk summary
An attacker with network access to a ksmbd SMB server could potentially trigger memory corruption by rapidly connecting and disconnecting SMB shares to create race conditions. This could lead to system crashes or potentially code execution with kernel privileges.
Vulnerability analysis
Summary: A use-after-free vulnerability in the ksmbd SMB server occurs when a tree connection object (tcon) is freed during disconnect while another thread still holds a reference to it.
Root Cause: The original fix in commit 33b235a6e6eb introduced a flawed reference counting mechanism using wait_event() to synchronize tree connection cleanup. Under high concurrency, the disconnect path would wait for the reference count to reach zero, then free the object, but other threads could still decrement the reference count and access the freed memory afterward.
Attack Surface: This vulnerability affects the ksmbd SMB server which handles network file sharing requests. It requires network access to the SMB service and the ability to establish and disconnect tree connections concurrently. The bug is triggered through normal SMB protocol operations under high concurrency scenarios.
Fix Mechanism: The patch simplifies the reference counting by removing the wait queue mechanism and using atomic_dec_and_test() consistently. Now both ksmbd_tree_connect_put() and ksmbd_tree_conn_disconnect() use atomic_dec_and_test() to safely free the tree connection object when the reference count reaches zero, eliminating the race window.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.15 | 5.15.199 | 446beed646b2 |
| 6.1 | 6.1.160 | d092de8a26c9 |
| 6.12 | 6.12.64 | 21a3d01fc6db |
| 6.18 | 6.18.3 | 063cbbc6f595 |
| 6.6 | 6.6.120 | d64977495e44 |
| mainline | 6.19 | b39a1833cc4a |