[SRU][J][PATCH 0/1] CVE-2025-22041

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-22041

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in ksmbd_sessions_deregister()

In multichannel mode, UAF issue can occur in session_deregister when the second
channel sets up a session through the connection of the first channel. session
that is freed through the global session table can be accessed again through
->sessions of connection.

[ Fix ]

jammy/linux: backported from 15a9605f8d69; backported to jammy/linux; review and refine this note

The fix addresses the use-after-free by ensuring that a session removed from
the global session table is also properly removed from the per-connection
->sessions list before it is freed, so that a session torn down via one
channel cannot be dereferenced again through another channel's connection.
The upstream commit was adjusted to apply cleanly on the jammy/linux tree;
the change is confined to the ksmbd session management code.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A regression would only affect systems running the in-kernel SMB server
(ksmbd) that share files over SMB3, and in particular deployments that rely on
SMB3 multichannel where a client establishes multiple channels for a single
session. A defect in this change could manifest as sessions being torn down
too early, connection or authentication failures, or a leak of session objects
under multichannel workloads. Systems that do not load or configure the ksmbd
module, and clients or servers using the userspace Samba stack instead, are not
affected by this change.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: 74824b88/v1