CVE-2025-68263 ksmbd: ipc: fix use-after-free in ipc_msg_send_request
A race condition in the Linux kernel's ksmbd module allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68263?
CVE-2025-68263 is a critical use after free vulnerability in Linux, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: ipc: fix use-after-free in ipc_msg_send_request
ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock.
Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event():
BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd] Write of size 12 at addr ffff888198ee6e20 by task pool/109349 ... Freed by task: kvfree ipc_msg_send_request [ksmbd] ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]
Fix by: - Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table. - Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock. - Returning NULL in the error path, preserving the original API semantics.
This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.
Which versions are affected by CVE-2025-68263?
How do I fix CVE-2025-68263?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-68263 being exploited?
There is no known exploitation of CVE-2025-68263 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68263, DEBIAN-CVE-2025-68263, GHSA-j5fg-gwpm-pjw5, ROOT-OS-DEBIAN-12-CVE-2025-68263, ROOT-OS-DEBIAN-13-CVE-2025-68263, ROOT-OS-UBUNTU-2204-CVE-2025-68263 and 2 more.