CVE-2025-38561
A race condition in the Linux kernel’s ksmbd service could let an attacker crash the service or potentially gain unauthorized access by sending multiple session setup requests. The issue has been fixed in recent kernel updates. Users should update their kernel to the patched version.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including Debian 11.0. Users running older kernel versions are affected.
Real-world impact
An attacker could crash the ksmbd service or cause a denial of service by sending many session setup requests, potentially leading to system instability or loss of data.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely with no authentication, no user interaction, and can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the ksmbd Preauh_HashValue race condition fix.
- 02Restart the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Aug 19, 2025 · Aug 19, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/44a3059c4c8cc635a1…patch
- git.kernel.org/stable/c/6613887da1d18dd2ec…patch
- git.kernel.org/stable/c/7d7c0c5304c88bcbd7…patch
- git.kernel.org/stable/c/b69fd87076daa66f3d…patch
- git.kernel.org/stable/c/edeecc7871e8fc0878…patch
- git.kernel.org/stable/c/fbf5c0845ed15122a7…patch
- zerodayinitiative.com/advisories/ZDI-25-916/third party advisory
- lists.debian.org/debian-lts-announce/2025/10…third party advisory