SB2025040242 - Use-after-free in Linux kernel smb server

Description

This security bulletin contains information about 1 security vulnerability.

1) Use-after-free (CVE-ID: CVE-2025-21967)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the alloc_opinfo(), smb2_lease_break_noti(), wait_lease_breaking(), oplock_break(), smb_send_parent_lease_break_noti(), smb_lazy_parent_lease_break_close(), smb_grant_oplock(), smb_break_all_write_oplock() and smb_break_all_levII_oplock() functions in fs/smb/server/oplock.c, within the ksmbd_alloc_work_struct() and ksmbd_free_work_struct() functions in fs/smb/server/ksmbd_work.c. A local user can escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/62746ae3f5414244a96293e3b017be637b641280
• https://git.kernel.org/stable/c/bb39ed47065455604729404729d9116868638d31
• https://git.kernel.org/stable/c/eb51f6f59d19b92f6fe84d3873f958495ab32f0a
• https://git.kernel.org/stable/c/fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.84