CVE-2025-68263
Kernel Live Patch Security Notice
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: ipc: fix use-after-free in ipc_msg_send_request
ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock.
Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event():
BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd] Write of size 12 at addr ffff888198ee6e20 by task pool/109349 ... Freed by task: kvfree ipc_msg_send_request [ksmbd] ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]
Fix by:
- Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table.
- Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock.
- Returning NULL in the error path, preserving the original API semantics.
This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.
Metrics
Affected operating systems
linux
amazon / amazon_linux
linux
ubuntu / awsbionic
linux
ubuntu / awsjammy
linux
ubuntu / awsnoble
linux
ubuntu / awsresolute
linux
ubuntu / awsxenial
linux
ubuntu / aws-6.8jammy
linux
ubuntu / aws-hwexenial
linux
ubuntu / azurejammy
linux
ubuntu / azurenoble
linux
ubuntu / azureresolute
linux
ubuntu / azurexenial
linux
ubuntu / azure-4.15bionic
linux
suse / basesystem_module15
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0
linux
debian / debian_linux13.0
linux
suse / development_tools_module15
linux
redhat / enterprise_linux10.0
linux
redhat / enterprise_linux8.0
linux
redhat / enterprise_linux9.0
linux
redhat / enterprise_linux_aus8.4
linux
redhat / enterprise_linux_aus8.6
linux
redhat / enterprise_linux_eus10.0
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
arista
cloudvision_agni2024.4.0 – 2025.2.2
arista
cloudvision_portal2024.2.0 – 2026.1.0
arista
velocloud_edge4.5.0 – 6.4.1
arista
velocloud_gateway
arista
velocloud_orchestrator
redhat
openshift_container_platform4.12 – 4.12.89
redhat
openshift_container_platform4.13 – 4.13.66
redhat
openshift_container_platform4.14 – 4.14.65
redhat
openshift_container_platform4.15 – 4.15.64
redhat
openshift_container_platform4.16 – 4.16.61
redhat
openshift_container_platform4.17 – 4.17.53
redhat
openshift_container_platform4.18 – 4.18.40
redhat
openshift_container_platform4.19 – 4.19.30
redhat
openshift_container_platform4.20 – 4.20.21
redhat
openshift_container_platform4.21 – 4.21.14
redhat
openshift_container_platform
siemens
simatic_ax_runtime
suse
caas_platform
suse
enterprise_storage
suse
manager_proxy
suse
manager_retail_branch_server
suse
manager_server
suse
openstack_cloud
suse
openstack_cloud_crowbar
References & sources
- https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589euvd
- https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181euvd
- https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062euvd
- https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202euvd
- https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114euvd
- https://git.kernel.org/stable/c/c2374b92c729d0388a538b3cde7b3e3b5e55ef39
- https://git.kernel.org/stable/c/38fdf04c602d52c42c67fc1617211492753b7e8b
- https://git.kernel.org/stable/c/f4858832ddef2f39f21e30b7226bbcd3c4b2bc96euvd
- https://git.kernel.org/stable/c/2f55b58b5a0bbed192d60c444a45a49cdf1b545feuvd
- https://git.kernel.org/stable/c/7962b522222628596ca9ecc8722efc95367aadbdeuvd
- https://git.kernel.org/stable/c/4dee4c0688443aaf5bbec74aa203c851d1d53c35euvd
- https://git.kernel.org/stable/c/1f2dc36c297d27733f1b380ea644cf15a361bd7beuvd
- https://git.kernel.org/stable/c/82d8701b2c930d0e96b0dbc9115a218d791cb0d2euvd
- https://git.kernel.org/stable/c/5202f071b367ffbc8e279fc7a00db14f5e587f52
- https://git.kernel.org/stable/c/69d1ce9c72eca91203ffdb8d08bacd511100aec6
- https://git.kernel.org/stable/c/e51238718217c4abdb3ccc3b0c0cde265c7ec629euvd
- https://git.kernel.org/stable/c/b2bd2ee73b697c177157bba534e1b1064c2e66a0euvd
- https://git.kernel.org/stable/c/29ef43ceb121d67b87f4cbb08439e4e9e732eff8euvd
- https://git.kernel.org/stable/c/1a6da3dbb9985d00743073a1cc1f96e59f5abc30euvd
- https://git.kernel.org/stable/c/145e50c2c700fa52b840df7bab206043997dd18eeuvd
Linked CVEs
- CVE-2026-47333
Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, l…
highCVSSv3 7.8 - CVE-2026-46319
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When look…
highCVSSv3 7.8 - CVE-2026-46304
In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_…
highCVSSv3 7.5 - CVE-2026-46274
In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending(…
highCVSSv3 7.8 - CVE-2026-46259
In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_ta…
highCVSSv3 7.8 - CVE-2026-46195
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers pars…
criticalCVSSv3 9.8 - CVE-2026-46185
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_che…
criticalCVSSv3 9.1 - CVE-2026-46135
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet…
criticalCVSSv3 9.8 - CVE-2026-46119
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing I…
criticalCVSSv3 9.1 - CVE-2026-46043
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rx…
criticalCVSSv3 9.1 - CVE-2026-45988
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet g…
criticalCVSSv3 9.8 - CVE-2026-43501
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv…
criticalCVSSv3 9.8 - CVE-2026-43493
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG r…
criticalCVSSv3 9.8 - CVE-2026-43407
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_repl…
criticalCVSSv3 9.1 - CVE-2026-43406
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_he…
criticalCVSSv3 9.1 - CVE-2026-43341
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioa…
criticalCVSSv3 9.8 - CVE-2026-43304
In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key,…
criticalCVSSv3 9.8 - CVE-2026-43186
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() O…
criticalCVSSv3 9.8 - CVE-2026-43185
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb…
criticalCVSSv3 9.8 - CVE-2026-43038
In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashik…
criticalCVSSv3 9.8 - CVE-2026-43037
A flaw was found in the Linux kernel's IPv6 tunnel implementation.
criticalCVSSv3 9.8 - CVE-2026-43011
In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x…
criticalCVSSv3 9.8 - CVE-2026-31705
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_g…
criticalCVSSv3 9.8 - CVE-2026-31659
In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_p…
criticalCVSSv3 9.8
Show 9 more CVEs
- CVE-2026-31657
In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_ad…
criticalCVSSv3 9.8 - CVE-2026-31637
In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ti…
criticalCVSSv3 9.8 - CVE-2026-31607
In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a…
criticalCVSSv3 9.8 - CVE-2026-31478
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_o…
criticalCVSSv3 9.8 - CVE-2026-31431Actively exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r…
criticalCVSSv3 7.8 - CVE-2026-31405
In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The u…
criticalCVSSv3 9.8 - CVE-2026-31402
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 re…
criticalCVSSv3 9.8 - CVE-2026-23455
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()…
criticalCVSSv3 9.1 - CVE-2026-23428
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_ge…
criticalCVSSv3 9.8