Heelan\u2019s investigation centered on ksmbd<\/em>, the Linux kernel server responsible for implementing the SMB3 protocol in kernel space for network file sharing.<\/p>\n\n\n\n Initially embarking on a manual audit of ksmbd<\/em> to benchmark o3\u2019s potential, Heelan quickly realized that the model was able to autonomously identify a complex use-after-free vulnerability in the handler for the SMB \u2018logoff\u2019 command\u2014an issue Heelan himself had not previously detected.<\/p>\n\n\n\n What makes this finding particularly remarkable is the vulnerability\u2019s nature, which involves concurrency and shared objects accessed across multiple threads.<\/p>\n\n\n\n The vulnerability occurs because one thread frees an object while another thread may still access it without proper synchronization, leading to use-after-free conditions that could allow kernel memory corruption and arbitrary code execution.<\/p>\n\n\n\n Before this breakthrough, Heelan used another vulnerability, CVE-2025-37778<\/a>, as a benchmark. This earlier flaw, known as the \u201cKerberos authentication vulnerability,\u201d is also a use-after-free bug triggered during Kerberos authentication in session setup requests.<\/p>\n\n\n\n While this vulnerability is remote and impactful, it is relatively contained, requiring the analysis of about 3,300 lines of kernel code. Heelan\u2019s method involved feeding o3 with code from specific SMB command handlers and related functions\u2014carefully curated to remain within the model\u2019s token limits.<\/p>\n\n\n\n The results were telling: across multiple runs, o3 identified the Kerberos authentication vulnerability significantly more often than previous models like Claude Sonnet 3.7, doubling or tripling detection rates. More impressively, OpenAI’s o3 produced bug reports that read more like those from human experts\u2014concise, focused, and easier to follow, although sometimes at the expense of detail.<\/p>\n\n\n\n Pushing further, Heelan expanded the scope by providing o3 with a larger codebase encompassing all SMB command handlers\u2014amounting to roughly 12,000 lines of code.<\/p>\n\n\n\n Despite a natural drop in performance due to scale, o3 still managed to pinpoint the Kerberos vulnerability. More intriguingly, it uncovered a previously unknown vulnerability: the very use-after-free bug in the session logoff handler that later became CVE-2025-37899.<\/p>\n\n\n\n This new vulnerability exploits a race condition between threads accessing the Heelan\u2019s analysis revealed that merely setting the pointer to NULL after freeing it was insufficient to prevent this bug due to SMB protocol features allowing multiple connections to bind to the same session.<\/p>\n\n\n\n Of course, he immediately reported the vulnerability. Upstream response was really fast, and the patches merged<\/a> for every still-maintained kernel branch.<\/p>\n\n\n\n So, the vulnerability is resolved in the kernel source; now it\u2019s just a matter of pulling the update from your distro. But the focus of the topic is different, as you guessed.<\/p>\n\n\n\n Without claiming to be 100% correct, this might be the first confirmed real-world case where AI helped uncover and fix a flaw in the Linux kernel\u2014a true precedent, no matter how you look at it. An example of synergy between human insight and machine intelligence.<\/p>\n\n\n\n And honestly, this could soon become the norm with the way things are going. Which, in my view, is totally fine\u2014and even expected.<\/p>\n\n\n\n Of course, AI is not flawless and can still produce errors (for now). However, there\u2019s no denying its incredible ability to carry out complex logical operations and reason through outcomes in ways that go far beyond what any one person could do.<\/p>\n\n\n\n That alone gives us good reason to believe we\u2019re standing at the edge of a new era\u2014one that could mark the next big leap in human technological evolution. And honestly, I don\u2019t think we\u2019ll have to wait long to see if that\u2019s true.<\/p>\n\n\n\nsess->user<\/code> structure. When one thread processes a LOGOFF command and frees this structure without adequate synchronization, other threads may still dereference the freed pointer, causing memory corruption or denial of service.<\/p>\n\n\n\n![\"A](\"https:\/\/linuxiac.com\/wp-content\/uploads\/2025\/05\/chatgpt-found-kernel-vulnerability-patch-1024x581.jpg\")
<\/a>