The Linux kernel's ksmbd IPC subsystem contained a use-after-free vulnerability (CVE-2025-68263) caused by a race condition between ipc_msg_send_request() and the generic netlink handler functions (handle_generic_event()/handle_response()). ipc_msg_send_request() waited for a netlink reply using a stack-allocated ipc_msg_table_entry. The handler filled entry->response under a lock, but ipc_msg_send_request() validated and freed entry->response without holding the same lock. Under high concurrency, this led to a race where handle_response() could write to freed memory, causing a slab-use-after-free detected by KASAN. The fix involved taking the ipc_msg_table_lock in ipc_msg_send_request() during validation and freeing to prevent concurrent access. This vulnerability affects Linux kernel versions prior to 5.15.0-1111.118~20.04.1 and related versions on Ubuntu 20.04.1. The CVSS 3.1 score is 9.8 (critical) with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has released patches and advises updating to fixed kernel versions and rebooting. The advisory also addresses numerous other kernel vulnerabilities in the same update.

Successful exploitation of this use-after-free vulnerability could allow an attacker to cause memory corruption in the kernel, potentially leading to system crashes (denial of service), arbitrary code execution with kernel privileges, or other system compromise. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

A patch is available from the vendor. Users should update their Linux kernel packages to the fixed versions listed in the Ubuntu security advisories USN-8094-1 and USN-8094-2 and reboot their systems to apply the fixes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigations are indicated by the vendor advisory.