CVE-2025-37778

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: Fix dangling pointer in krb_authenticate

krb_authenticate frees sess->user and does not set the pointer to NULL. It calls ksmbd_krb5_authenticate to reinitialise sess->user but that function may return without doing so. If that happens then smb2_sess_setup, which calls krb_authenticate, will be accessing free'd memory when it later uses sess->user.

This vulnerability does not affect supported Red Hat Enterprise Linux kernels because the in-kernel SMB server (ksmbd) is not enabled or distributed in Red Hat products. The flaw involves a use-after-free condition during Kerberos authentication handling within the ksmbd network service, which could allow an attacker to cause system instability or memory corruption on systems running upstream kernels with ksmbd active. Because Red Hat relies on user-space Samba implementations rather than the in-kernel SMB service, Red Hat systems remain unaffected.