Linux Kernel ksmbd CVE-2025-22037

Exploitation requires the target to have the in-kernel SMB server ksmbd compiled, enabled, and listening (typically TCP 445) and reachable by the attacker - this is a non-default configuration that most Linux distributions ship disabled, which is the primary limiting factor. The specific trigger is a protocol-state ordering abuse: the attacker first sends a malformed SMB2 negotiate request (so ksmbd returns an error and never allocates conn->preauth_info), then sends an SMB2 session setup request before the negotiate phase completes, reaching alloc_preauth_hash() with an unallocated structure. No authentication is required (CVSS PR:N), no user interaction (UI:N), and complexity is low (AC:L); the realistic risk is bounded to environments that deliberately run ksmbd as an SMB file-sharing server.

This is an availability-only denial-of-service flaw (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - a NULL pointer dereference (CWE-476) in the Linux kernel's in-kernel SMB server (ksmbd) that crashes the kernel; there is no confidentiality or integrity impact. The signals are consistent but modest: the CVSS vector indicates a low-complexity, pre-authentication, network-reachable trigger, yet EPSS is only 0.14% (34th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation - 'no public exploit identified at time of analysis.' A Zero Day Initiative advisory (ZDI-25-310) exists, indicating the issue was formally researched and disclosed, but the input does not flag public POC code, so POC availability is unconfirmed. The high CVSS is driven entirely by the A:H availability weight; the real-world priority is tempered by the fact that ksmbd is an optional, non-default kernel component that must be explicitly enabled and exposed. Net: a legitimate patch-worthy remote DoS for systems actually running ksmbd, but not a drop-everything issue - low EPSS and absence from KEV argue against urgent widespread exploitation.

An attacker with network reach to a host running the in-kernel SMB server (ksmbd) on port 445 sends a malformed SMB2 negotiate request, which ksmbd rejects without allocating conn->preauth_info. The attacker immediately follows with an SMB2 session setup request; ksmbd dereferences the unallocated preauth structure in alloc_preauth_hash(), causing a NULL pointer dereference that panics/crashes the kernel. No authentication or user interaction is required, but there is no public exploit confirmed and the attack yields only denial of service.