CVE-2025-68263ksmbd: ipc: fix use-after-free in ipc_msg_send_request
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock. Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event(): BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd] Write of size 12 at addr ffff888198ee6e20 by task pool/109349 ... Freed by task: kvfree ipc_msg_send_request [ksmbd] ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd] Fix by: - Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table. - Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock. - Returning NULL in the error path, preserving the original API semantics. This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0626e6641f6b467447c81dd7678a69c66f7746cf before de85fb58f9967ba024bb08e0041613d37b57b4d1; from 0626e6641f6b467447c81dd7678a69c66f7746cf before 708a620b471a14466f1f52c90bf3f65ebdb31460; 0626e6641f6b467447c81dd7678a69c66f7746cf builds before 5ac763713a1ef8f9a8bda1dbd81f0318d67baa4e; from 0626e6641f6b467447c81dd7678a69c66f7746cf before 759c8c30cfa8706c518e56f67971b1f0932f4b9b; from 0626e6641f6b467447c81dd7678a69c66f7746cf before 8229c6ca50cea701e25a7ee25f48441b582ec5fa; 0626e6641f6b467447c81dd7678a69c66f7746cf builds before 1fab1fa091f5aa97265648b53ea031deedd26235 | CNA record |
References
- https://git.kernel.org/stable/c/de85fb58f9967ba024bb08e0041613d37b57b4d1
- https://git.kernel.org/stable/c/708a620b471a14466f1f52c90bf3f65ebdb31460
- https://git.kernel.org/stable/c/5ac763713a1ef8f9a8bda1dbd81f0318d67baa4e
- https://git.kernel.org/stable/c/759c8c30cfa8706c518e56f67971b1f0932f4b9b
- https://git.kernel.org/stable/c/8229c6ca50cea701e25a7ee25f48441b582ec5fa
- https://git.kernel.org/stable/c/1fab1fa091f5aa97265648b53ea031deedd26235
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.