Answer in brief
CVE-2025-37778 records a Unknown severity vulnerability in ksmbd: Fix dangling pointer in krb_authenticate. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2025-37778 records a Unknown severity vulnerability in ksmbd: Fix dangling pointer in krb_authenticate. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0626e6641f6b467447c81dd7678a69c66f7746cf <b61f04d5d73c53d183019bafe22fb700a739bac5 || >=0626e6641f6b467447c81dd7678a69c66f7746cf <d5b554bc8d554ed6ddf443d3db2fad9f665cec10 || >=0626e6641f6b467447c81dd7678a69c66f7746cf <1db2451de23e98bc864c6a6e52aa0d82c91cb325 || >=0626e6641f6b467447c81dd7678a69c66f7746cf <6e30c0e10210c714f3d4453dc258d4abcc70364e || >=0626e6641f6b467447c81dd7678a69c66f7746cf <e83e39a5f6a01a81411a4558a59a10f87aa88dd6 || >=0626e6641f6b467447c81dd7678a69c66f7746cf <1e440d5b25b7efccb3defe542a73c51005799a5f | b61f04d5d73c53d183019bafe22fb700a739bac5, d5b554bc8d554ed6ddf443d3db2fad9f665cec10, 1db2451de23e98bc864c6a6e52aa0d82c91cb325, 6e30c0e10210c714f3d4453dc258d4abcc70364e, e83e39a5f6a01a81411a4558a59a10f87aa88dd6, 1e440d5b25b7efccb3defe542a73c51005799a5f |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
May 1, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL. It calls ksmbd_krb5_authenticate to reinitialise sess->user but that function may return without doing so. If that happens then smb2_sess_setup, which calls krb_authenticate, will be accessing free'd memory when it later uses sess->user.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0626e6641f6b467447c81dd7678a69c66f7746cf <b61f04d5d73c53d183019bafe22fb700a739bac5 || >=0626e6641f6b467447c81dd7678a69c66f7746cf <d5b554bc8d554ed6ddf443d3db2fad9f665cec10 || >=0626e6641f6b467447c81dd7678a69c66f7746cf <1db2451de23e98bc864c6a6e52aa0d82c91cb325 || >=0626e6641f6b467447c81dd7678a69c66f7746cf <6e30c0e10210c714f3d4453dc258d4abcc70364e || >=0626e6641f6b467447c81dd7678a69c66f7746cf <e83e39a5f6a01a81411a4558a59a10f87aa88dd6 || >=0626e6641f6b467447c81dd7678a69c66f7746cf <1e440d5b25b7efccb3defe542a73c51005799a5f | b61f04d5d73c53d183019bafe22fb700a739bac5, d5b554bc8d554ed6ddf443d3db2fad9f665cec10, 1db2451de23e98bc864c6a6e52aa0d82c91cb325, 6e30c0e10210c714f3d4453dc258d4abcc70364e, e83e39a5f6a01a81411a4558a59a10f87aa88dd6, 1e440d5b25b7efccb3defe542a73c51005799a5f |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
May 1, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL. It calls ksmbd_krb5_authenticate to reinitialise sess->user but that function may return without doing so. If that happens then smb2_sess_setup, which calls krb_authenticate, will be accessing free'd memory when it later uses sess->user.
Quoted source text, attributed separately from HOL analysis.