CVE-2025-37962 describes a memory leak in the Linux kernel's ksmbd SMB network file system component. The leak occurs in the parse_lease_state() function when a bounds check for creating a lease context fails; the function returns NULL without freeing the previously allocated lease_ctx_info structure. This patch corrects the issue by ensuring kfree(lreq) is called before returning NULL in failure cases. The vulnerability is part of a broader set of Linux kernel security fixes affecting multiple subsystems and architectures. The vendor advisory from Ubuntu confirms the availability of patches in Linux kernel version 6.14.0-28.28 and related HWE and OEM kernel packages. Users must update and reboot to apply the fixes, and recompile third-party kernel modules due to ABI changes.

The vulnerability causes a memory leak in the kernel's SMB server component, which could lead to resource exhaustion and potential denial of service. There is no indication of confidentiality, integrity, or privilege escalation impact. The CVSS score is 5.5 (medium severity) with an attack vector of local, requiring low complexity and low privileges, and no user interaction. No known exploits in the wild have been reported.

A patch is available and included in the Linux kernel updates distributed by Ubuntu. Users should apply the kernel updates as per the vendor advisory (Ubuntu Security Notices USN-7699-1 and USN-7699-2) and reboot their systems to activate the fixes. Due to ABI changes, recompilation and reinstallation of all third-party kernel modules are required. Follow the vendor's update instructions carefully to ensure complete remediation.