CVE-2025-37924

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in kerberos authentication

Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL.

This vulnerability does not affect Red Hat Enterprise Linux as the in-kernel SMB server module (ksmbd) is not enabled in Red Hat kernel builds. Red Hat supported platforms utilize user-space Samba services for SMB file sharing rather than this in-kernel driver. Consequently, systems running Red Hat Enterprise Linux are not exposed to this flaw.