CVE-2025-22040

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix session use-after-free in multichannel connection

There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed before the connection is added to channel list of session. This patch check reference count of session before freeing it.

This vulnerability is rated as Important because an authenticated user could exploit a race condition during SMB session handling to trigger memory corruption or kernel crashes, potentially compromising the host. Red Hat Enterprise Linux does not enable or compile the in-kernel SMB server (ksmbd), relying instead on user-space implementations such as Samba. As a result, default Red Hat Enterprise Linux installations are not vulnerable to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.