Skip to main content

Linux CVE-2025-39933

| EUVDEUVD-2025-32405 MEDIUM
2025-10-04 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Impact

CVSS 5.5. EPSS 0.0%. Vendor patch available.
Exploit ScenarioDerived

An attacker could exploit this vulnerability in the affected application to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

CVE-2025-39933 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

Earlier versions of this analysis (1)
v1 Mar 13, 2026 - 19:56 CVSS 5.5

In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.

RemediationAI

Apply the vendor-supplied patch immediately.

Affected VersionsENISA

Linux f198186aa9bbd60fae7a2061f4feec614d880299 <f57e53ea252363234f86674db475839e5b87102e
Linux patch: 6.17
Linux patch: 0
Linux f198186aa9bbd60fae7a2061f4feec614d880299 <581fb78e0388b78911b0c920e4073737090c8b5f
Linux patch: 6.16.9
Linux 4.16

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Vulnerability type not specified by vendor.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 7.1 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 25, 2026 - 00:51 nvd
Patch available
CVE Published
Oct 04, 2025 - 08:15 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

smb: client: let recv_done verify data_offset, data_length and remaining_data_length

This is inspired by the related server fixes.

Executive ViewAI

Why It Matters

CVE-2025-39933 presents moderate security risk rated CVSS 5.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.0%
Top 97% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
PATCH https://git.kernel.org/stable/c/581fb78e0388b78911b0c920e4073737090c8b5f PATCH https://git.kernel.org/stable/c/f57e53ea252363234f86674db475839e5b87102e ADVISORY https://access.redhat.com/errata/RHSA-2026:0759 ADVISORY https://access.redhat.com/errata/RHSA-2026:0760 ADVISORY https://access.redhat.com/errata/RHSA-2026:0793 ADVISORY https://access.redhat.com/errata/RHSA-2026:1727 ADVISORY https://access.redhat.com/errata/RHSA-2026:2282 ADVISORY https://access.redhat.com/errata/RHSA-2026:2759 ADVISORY https://access.redhat.com/errata/RHSA-2026:2766 ADVISORY https://access.redhat.com/errata/RHSA-2026:3267 ADVISORY https://access.redhat.com/errata/RHSA-2026:3268 ADVISORY https://access.redhat.com/errata/RHSA-2026:3277 ADVISORY https://access.redhat.com/errata/RHSA-2026:3293 ADVISORY https://access.redhat.com/errata/RHSA-2026:3358 ADVISORY https://access.redhat.com/errata/RHSA-2026:3360 ADVISORY https://access.redhat.com/errata/RHSA-2026:3375 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-39933 ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/327022 REF https://git.kernel.org/stable/c/241e58de23e7c1bbb9bee526c17d9a0f2a90fbad REF https://git.kernel.org/stable/c/f23d5c6b7540ec9b1e73a8ea3b2ae9045248d728 REF https://git.kernel.org/stable/c/fdc23a47be015fba915c4f9dfd43c65ad4829a35

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy