CVE-2025-37776

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

ksmbd is the in-kernel SMB server on TCP/445, and every trigger path (SMB2 WRITE, CREATE with O_TRUNC, SET_INFO alloc-size/rename, IOCTL copychunk/zero-data, LOCK) is driven entirely by remote SMB2 traffic. No local access is required.

AC:LAttack complexity, low

The attacker controls both sides of the race: one connection holds the level-II oplock and simply withholds the SMB2_OPLOCK_BREAK ack, pinning the RCU-unlocked window open for up to OPLOCK_WAIT_TIME (35 s), while other connections close handles on the same inode to drive opinfo_del()/opinfo_put(). An attacker-created race with a multi-second window is reliably winnable and repeatable.

PR:LPrivileges required, low

All call sites dereference work->tcon->share_conf, so a completed SESSION_SETUP and TREE_CONNECT are needed — any unprivileged share account (including guest where "map to guest" is configured) suffices, with no administrative rights. This matches the sibling post-authentication ksmbd UAFs.

UI:NUser interaction, none

The attacker drives every step from its own SMB connections — taking the oplock, stalling the break ack, and closing handles concurrently. No action by an administrator or any other client is needed.

S:UScope, unchanged

The freed object and the resulting corruption are both inside the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

The ~176-byte oplock_info lives in the general kmalloc-192 cache and is remotely sprayable, so the freed object can be reclaimed with attacker-controlled bytes at the op_entry.next offset, yielding a chosen brk_op whose ->conn and ->o_lease->state dereferences give arbitrary kernel memory disclosure.

I:HIntegrity impact, high

With a controlled brk_op pointer, atomic_inc_not_zero(&brk_op->refcount) is an arbitrary-address increment write, and oplock_break() then manipulates wait-queue lists and queues work off the fake object — a use-after-free that is exploitable for control-flow hijack and arbitrary kernel code execution.

A:HAvailability impact, high

Even unweaponized, following op_entry.next out of a freed oplock_info dereferences freed/poisoned memory and reliably oopses or panics the kernel, and the attacker can repeat the sequence to keep the SMB server down.