Research explained
How o3 helped a researcher find a Linux SMB memory-safety flaw
The vulnerability affected Linux ksmbd; OpenAI’s model was used during discovery.
What happened
In May 2025, researcher Sean Heelan described using o3 during an investigation of Linux’s ksmbd implementation. The work uncovered CVE-2025-37899, a use-after-free involving the SMB logoff handler and concurrent connections.
The affected software is the Linux SMB implementation. The involvement of an AI model in finding the bug does not make OpenAI the vulnerable vendor.
Heelan’s account is useful because it describes the evaluation setup, code context, and limitations rather than only announcing a successful result. For teams evaluating AI-assisted research, retain that distinction: a valid finding is evidence of capability, not a guarantee that every run will be accurate.
Operators should consult their Linux distributor’s advisory for package applicability and fixes. This retrospective does not determine whether a specific host is exposed.
What we know
- Affected component
- Linux ksmbd
- AI role
- Discovery assistance
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
SEA
Technical details
- CVE
CVE-2025-37899