Vulnerability Targets Linux SMB Component
The vulnerability, confirmed on May 20, 2025, affects the ksmbd component, a built-in SMB3 file-sharing server in the Linux kernel. It involves a use-after-free error in the handler for the SMB “logoff” command, which could allow attackers to corrupt memory or execute code with kernel-level access.
The issue arises when one thread processes a logoff request and frees the sess->user object. Meanwhile, another thread attempting to bind to the same session via a session setup command may still access that freed memory—creating a classic concurrency bug.
AI Plays Central Role in Discovery
The vulnerability was discovered by a researcher named Sean, who stated, “I found the vulnerability with nothing more complicated than the o3 API—no scaffolding, no agentic frameworks, no tool use.” He believes this is the first publicly disclosed vulnerability found directly through a large language model.
OpenAI’s o3 model, launched in April 2025, is designed to “think longer” and handle complex tasks more effectively. Its ability to reason about concurrency and low-level code proved essential in spotting the flaw.
“With o3, LLMs have made a leap forward in their ability to reason about code,” Sean added. “They are now at a stage where they can make you significantly more efficient and effective.”
Risk Assessment and Patching Efforts
Security experts have rated the vulnerability as high severity. However, the Exploit Prediction Scoring System (EPSS) estimates the likelihood of exploitation at only 0.02% for now.
The flaw impacts Linux kernel versions up to 6.12.27, 6.14.5, and 6.15-rc4. Distributions such as SUSE are already developing patches, with the SUSE Security Team currently categorizing the issue as “moderate severity.”
Implications for AI in Cybersecurity
This discovery signals a new era in cybersecurity, where AI tools can act as powerful assistants rather than replacements for human researchers.
“If you’re an expert-level vulnerability researcher or exploit developer, the machines aren’t about to replace you,” Sean emphasized. “In fact, they now enhance your ability to identify and understand complex bugs.”
As AI models like o3 continue to evolve, the role of human-AI collaboration is expected to become standard in proactive cybersecurity defense strategies.
