CVE-2025-21967

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

ksmbd is the in-kernel SMB server listening on TCP/445, and the entire trigger sequence (a CREATE requesting a batch oplock/write lease on one connection, a conflicting overwrite CREATE plus a close/disconnect on a second) is driven purely by remote SMB2 protocol traffic. No local access to the target is required.

AC:LAttack complexity, low

The double `list_add` of the same `work->interim_entry` in `smb2_open()` is deterministic, not racy, and the attacker owns both connections so it chooses exactly when the peer's `oplock_info` is released relative to `ksmbd_free_work_struct()`, and can loop the sequence indefinitely. Per guidance, an attacker-created ordering and a use-after-free are Low.

PR:LPrivileges required, low

Reaching `smb_grant_oplock()`/`smb_break_all_oplock()` requires a completed SESSION_SETUP, TREE_CONNECT and SMB2 CREATE, so an authenticated but otherwise unprivileged share account (including a mapped guest) is needed. This matches the scoring of the sibling post-authentication ksmbd oplock UAFs.

UI:NUser interaction, none

The attacker drives every step from its own two SMB sessions — take the oplock, issue the conflicting overwrite CREATE, then close or drop the first connection. No administrator or other client has to do anything.

S:UScope, unchanged

The list corruption and its consequences stay entirely within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

The stale `interim_list` head lets `smb2_lease_break_noti()` treat reclaimed heap memory as a `struct ksmbd_work`, dereferencing its `conn`, `sess`, and `request_buf` fields, and `smb2_send_interim_resp()` then transmits data derived from that object back to the attacker — an arbitrary kernel memory disclosure primitive after a heap spray.

I:HIntegrity impact, high

`list_del()` in `ksmbd_free_work_struct()` writes two attacker-influenced kernel heap pointers at a fixed offset into a freed kmalloc-256 slot that the attacker can reclaim with a chosen object, and the fake-`ksmbd_work` path yields further controlled pointer writes and indirect calls, giving control-flow hijack.

A:HAvailability impact, high

Even unweaponized, the `list_del` on freed memory trips `CONFIG_DEBUG_LIST`/`BUG()` or silently corrupts the slab, and walking the dangling `interim_list` oopses the ksmbd worker; the attacker can repeat it at will to keep the file server down.