CVE-2025-68263

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: ipc: fix use-after-free in ipc_msg_send_request

ipc_msg_send_request() waits for a generic netlink reply using an

ipc_msg_table_entry on the stack. The generic netlink handler

(handle_generic_event()/handle_response()) fills entry->response under

ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free

entry->response without holding the same lock.

Under high concurrency this allows a race where handle_response() is

copying data into entry->response while ipc_msg_send_request() has just

freed it, leading to a slab-use-after-free reported by KASAN in

handle_generic_event():

BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd]

Write of size 12 at addr ffff888198ee6e20 by task pool/109349

...

Freed by task:

kvfree

ipc_msg_send_request [ksmbd]

ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]

Fix by:

- Taking ipc_msg_table_lock in ipc_msg_send_request()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References