HOW I USED O3 TO FIND CVE-2025-37899, A REMOTE ZERO-DAY VULNERABILITY IN THE LINUX KERNEL'S SMB IMPLEMENTATION

Summary from the TLDR InfoSec newsletter

A security researcher used OpenAI's o3 model to find CVE-2025-37899, a previously unknown zero-day use-after-free vulnerability in the Linux kernel's SMB implementation (ksmbd). The flaw occurs when one thread frees a session user object while another thread on a concurrent connection is still accessing it, leading to potential kernel memory corruption. This represents the first documented case of an LLM discovering a vulnerability requiring complex reasoning about concurrent execution paths, demonstrating that o3 has achieved a significant breakthrough in automated code analysis capabilities that can be utilized for bug hunting.