CVE-2025-37776 ksmbd: fix use-after-free in smb_break_all_levII_oplock()

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Address Use-After-Free Vulnerabilities in ksmbd Two CVEs related to the ksmbd component have been published, addressing use-after-free vulnerabilities. CVE-2025-21945, published on April 1, 2025, affects the smb2_lock function, while CVE-2025-37776, published on May 1, 2025, concerns the smb_break_all_levII_oplock function. These vulnerabilities could potentially impact systems utilizing ksmbd. 2 sources 45