Linux Kernel ksmbd Flaw Lets Remote Attackers Execute Arbitrary Code

A critical vulnerability in the Linux Kernel’s ksmbd file sharing component allows remote attackers to execute code with kernel privileges, tracked as CVE-2025-38561. Authentication is required, but a successful exploit can grant full control of the affected host, and many environments expose SMB servers to wide networks, increasing risk.

The flaw resides in the handling of the Preauth_HashValue field during SMB2 session setup, where improper locking creates a race condition that can lead to arbitrary code execution in the kernel context; the CVSS 3.1 base score is 8.5. The issue affects ksmbd SMB2 server module in Linux and any distribution incorporating the vulnerable kernel versions; Linux maintainers have released a patch to fix the race condition by adding proper locking around the Preauth_HashValue operations.

The flaw was reported privately on 22 July 2025 and publicly disclosed on 24 September 2025, with a report by ZDI noting the unsynchronised memory access. According to ZDI, an attacker with valid credentials can trigger the race and gain the highest privilege level, underscoring the need to identify vulnerable systems and apply the latest security update.