CVE-2025-37962: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2025-37962) was discovered in the Linux kernel's ksmbd component, specifically in the parseleasestate() function. The vulnerability was disclosed on May 20, 2025, affecting the Linux kernel's implementation of the SMB protocol server (ksmbd). The issue stems from a previous patch that added bounds checking for create lease context but introduced a memory leak (NVD, Wiz).

When the bounds check fails, the function returns NULL without freeing the previously allocated leasectxinfo structure, leading to a memory leak condition. The vulnerability affects various Linux distributions including Ubuntu and Debian systems (NVD).

The vulnerability results in a memory leak in the Linux kernel's ksmbd component, which could potentially lead to resource exhaustion over time if repeatedly triggered (Wiz).

The issue has been resolved by adding kfree(lreq) before returning NULL in both boundary check cases. This ensures proper cleanup of allocated memory resources when the bounds check fails. The fix has been implemented in various Linux distributions including Debian and Ubuntu (NVD, Debian).