Paper/Archive/CVE-2025-39943

CVE-2025-39943

Linux Linux — ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 18.3.183 × 203.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done.

Affected

ProductAffectedFixed inSource

Linux2ea086e35c3d726a3bacd0a971c1f02a50e98206 – < 773fddf976d282ef059c36c575ddb81567acd6bc773fddf976d282ef059c36c575ddb81567acd6bcCNA

Linux2ea086e35c3d726a3bacd0a971c1f02a50e98206 – < bdaab5c6538e250a9654127e688ecbbeb6f771d5bdaab5c6538e250a9654127e688ecbbeb6f771d5CNA

Linux2ea086e35c3d726a3bacd0a971c1f02a50e98206 – < eb0378dde086363046ed3d7db7f126fc3f76fd70eb0378dde086363046ed3d7db7f126fc3f76fd70CNA

Linux2ea086e35c3d726a3bacd0a971c1f02a50e98206 – < 8be498fcbd5b07272f560b45981d4b9e5a2ad8858be498fcbd5b07272f560b45981d4b9e5a2ad885CNA

Linux2ea086e35c3d726a3bacd0a971c1f02a50e98206 – < 529b121b00a6ee3c88fb3c01b443b2b81f686d48529b121b00a6ee3c88fb3c01b443b2b81f686d48CNA

Linux2ea086e35c3d726a3bacd0a971c1f02a50e98206 – < 5282491fc49d5614ac6ddcd012e5743eecb6a67c5282491fc49d5614ac6ddcd012e5743eecb6a67cCNA

Linux5.155.15.194CNA

Scores by source

Linux (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

References

refgit.kernel.org/stable/c/773fddf976d282ef059c36c575ddb81567acd6bc refgit.kernel.org/stable/c/bdaab5c6538e250a9654127e688ecbbeb6f771d5 refgit.kernel.org/stable/c/eb0378dde086363046ed3d7db7f126fc3f76fd70 refgit.kernel.org/stable/c/8be498fcbd5b07272f560b45981d4b9e5a2ad885 refgit.kernel.org/stable/c/529b121b00a6ee3c88fb3c01b443b2b81f686d48 refgit.kernel.org/stable/c/5282491fc49d5614ac6ddcd012e5743eecb6a67c