[SRU][J][PATCH 0/1] CVE-2025-37777

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-37777

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in __smb2_lease_break_noti()

Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is referenced
when ksmbd server thread terminates, It will not be freed, but
conn->tcp_transport is freed. __smb2_lease_break_noti can be performed
asynchronously when the connection is disconnected. __smb2_lease_break_noti
calls ksmbd_conn_write, which can cause use-after-free when
conn->ksmbd_transport is already freed.

[ Fix ]

jammy/linux: backported from 21a4e47578d4

The backport relocates the freeing of the TCP transport so that it happens
during the final connection release rather than when the server thread
terminates. In this tree an earlier refactor already moved the refcount-zero
final release into ksmbd_conn_put(), so the transport free was placed in that
atomic_dec_and_test block, before the connection object itself is freed, which
is the true analogue of the upstream ksmbd_conn_free() change.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A regression would most likely surface on systems acting as an in-kernel SMB
file server (ksmbd), particularly under client disconnects that race with
oplock or lease break notifications; a mistake in the transport lifetime
handling could instead leak the transport, leave it freed too early, or free
it twice on connection teardown. Systems that do not load or run the ksmbd
server are not affected, and SMB clients (including cifs.ko mounts) are
unaffected because the change touches only the server-side connection path.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: 62437abd/v1