What is the CVSS score of CVE-2025-39943?

CVE-2025-39943 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-39943?

Yes, a patch is available for CVE-2025-39943. Update the affected software to the latest version immediately.

Linux CVE-2025-39943

EUVD-2025-32382 HIGH

Out-of-bounds Read (CWE-125)

2025-10-04 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Buffer Overflow Information Disclosure Linux

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:07 vuln.today

Patch released

Apr 06, 2026 - 13:28 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 19:56 euvd

EUVD-2025-32382

CVE Published

Oct 04, 2025 - 08:15 nvd

HIGH 7.1

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer

If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done.

AnalysisAI

Out-of-bounds read in the Linux kernel's ksmbd SMB Direct transport allows local authenticated attackers to read sensitive kernel memory and cause a denial of service. The vulnerability stems from missing validation of the data_offset and data_length fields in SMBDirect data transfer structures, leading to potential information disclosure and kernel crashes. Vendor patches have been released; no public exploit or active exploitation is currently known.

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2025-39943 vulnerability details – vuln.today

Back

Linux CVE-2025-39943

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code