CVE-2025-37750 is a use-after-free (UAF) vulnerability in the Linux kernel's SMB (Server Message Block) client implementation, specifically related to the handling of multichannel decryption. The vulnerability arises after two commits intended to optimize cryptographic resource allocation and fix asynchronous decryption UAF issues. These changes led to multiple CIFS daemon (cifsd) threads, each representing a channel in SMB multichannel communication, reusing the AEAD (Authenticated Encryption with Associated Data) transform object from the primary channel for synchronous decryption. This reuse is unsafe because concurrent access by multiple threads can lead to a use-after-free condition. The vulnerability manifests as a kernel memory corruption detected by Kernel Address Sanitizer (KASAN), causing slab-use-after-free errors during cryptographic operations (specifically in the gf128mul_4k_lle function used for Galois/Counter Mode (GCM) hashing). The issue was reproducible when running filesystem tests with SMB version 3.1.1 multichannel enabled against Windows Server 2022. Exploitation could lead to kernel crashes or potentially arbitrary code execution in kernel space due to memory corruption. The vulnerability affects multiple Linux kernel versions identified by specific commit hashes, indicating it is present in recent kernel releases prior to the fix. No CVSS score has been assigned yet, and no known exploits are reported in the wild at the time of publication (May 2025).

For European organizations, this vulnerability poses a significant risk, especially for those relying on Linux servers for file sharing and network storage using SMB protocol with multichannel support enabled. The use-after-free flaw can lead to kernel panics, causing denial of service (DoS) conditions, disrupting critical services and business operations. More critically, if exploited, it could allow attackers to execute arbitrary code with kernel privileges, compromising system confidentiality, integrity, and availability. This could lead to unauthorized access to sensitive data, lateral movement within networks, and persistent footholds. Given the widespread use of Linux in enterprise environments, cloud infrastructure, and critical systems across Europe, the vulnerability could impact sectors such as finance, healthcare, government, and telecommunications. The complexity of the vulnerability and requirement for multichannel SMB configuration may limit exploitation to targeted attacks, but the potential severity remains high.

European organizations should prioritize updating their Linux kernel to versions that include the fix for CVE-2025-37750 as soon as patches become available. Until patches are applied, organizations should consider disabling SMB multichannel support on Linux clients and servers where feasible to reduce exposure. Network segmentation and strict access controls should be enforced to limit SMB traffic to trusted hosts only. Monitoring kernel logs for KASAN alerts or unusual SMB client behavior can help detect attempted exploitation. Additionally, organizations should audit their SMB configurations to ensure minimal exposure and apply principle of least privilege to SMB shares. For environments using Windows Server 2022 as SMB servers, ensure they are also fully patched to avoid triggering the vulnerability during SMB interactions. Finally, maintain up-to-date intrusion detection systems (IDS) and endpoint detection and response (EDR) solutions capable of identifying anomalous kernel-level activities related to SMB operations.