CVE-2025-68817: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68817 is a use-after-free vulnerability in the Linux kernel's ksmbd (in-kernel SMB server) component, specifically in the ksmbd_tree_connect_put function. Under high concurrency conditions, a tree-connection object (tcon) is freed on a disconnect path while another concurrent execution path still holds a reference and subsequently performs *_put()/write operations on the already-freed object. The vulnerability was published on January 13, 2026, and affects multiple stable Linux kernel branches. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, kernel.org).

The root cause is a race condition in ksmbd's tree-connection lifecycle management, classified as CWE-416 (Use After Free). When multiple SMB sessions operate concurrently, the disconnect path can free a tcon object while a second code path — which still holds a valid reference — later dereferences or writes to that freed memory region. This is a local attack vector requiring low privileges and no user interaction; an attacker must have local access to a system running the ksmbd SMB server under concurrent load to trigger the race. Affected kernel version ranges include 5.15.145–5.15.198, 6.1.71–6.1.159, 6.6 (rc5/rc6/rc7 and 6.6.1–6.6.119), 6.7–6.12.63, and 6.13–6.18.2 (Feedly).

Successful exploitation can result in kernel memory corruption, which may lead to disclosure of sensitive kernel memory contents (confidentiality impact), unauthorized modification of kernel memory enabling privilege escalation (integrity impact), or a kernel crash causing denial of service (availability impact). Because the vulnerability operates at the kernel level, a successful privilege escalation could grant an attacker full control of the affected system. The attack is limited to the local system scope and requires the ksmbd SMB server to be active and under concurrent connection load (Feedly).

There is no public proof-of-concept exploit known at this time, and no evidence of in-the-wild exploitation has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and the ability to trigger high-concurrency SMB connection scenarios, which limits the practical attack surface (Feedly).

Patches are available across all affected stable kernel branches. Administrators should update to the following fixed versions or later: 5.15.199 (for 5.15.145–5.15.198), 6.1.160 (for 6.1.71–6.1.159), 6.6.120 (for 6.6.1–6.6.119), 6.12.64 (for 6.7–6.12.63), and 6.18.3 (for 6.13–6.18.2). Upstream patch commits are available at git.kernel.org (commit hashes: 063cbbc6, 21a3d01f, 446beed6, b39a1833, d092de8a, d64977495). If immediate patching is not feasible, consider disabling the ksmbd module (modprobe -r ksmbd) if the in-kernel SMB server is not required, and restrict local user access on affected systems (Feedly, kernel.org patches).