Skip to main content

Linux Kernel CVE-2025-39975

CRITICAL
2025-10-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Requires the client to connect to an attacker-controlled/MITM SMB server and hit the compound path, so UI:R and AC:H; kernel OOB access yields high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.8 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:08 vuln.today
CVE Published
Oct 15, 2025 - 08:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix wrong index reference in smb2_compound_op()

In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes.

This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index is greather than or equal to MAX_COMPOUND, it can cause out-of-bounds accesses.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's in-kernel SMB/CIFS client (smb2_compound_op() in fs/smb/client) stems from wrong index references when iterating over compound SMB2 response buffers; a computed index at or above MAX_COMPOUND drives reads/writes past the response array. A machine mounting a share from a malicious or compromised SMB server can have its kernel process attacker-influenced compound responses, leading to memory corruption, denial of service, or potential privilege escalation. It carries a CNA-assigned CVSS 9.8, but there is no public exploit identified at time of analysis and EPSS is very low (0.19%, 8th percentile), so real-world exploitation pressure is currently minimal.

Technical ContextAI

The affected component is the Linux kernel's native SMB3 client (the cifs/smb-client module used for mounting Windows/Samba shares). SMB2/3 supports 'compounding,' where multiple related operations (e.g., create, query, close) are packed into a single request and returned as a chained set of responses. smb2_compound_op() loops over these chained responses to map each command to its result buffer. The bug is a wrong-index (off-by/mis-mapped index) defect: the loop dereferences response buffers with an incorrect index, so results are attributed to the wrong command and, when the miscomputed index reaches or exceeds MAX_COMPOUND (the fixed bound on operations in a compound), the access falls outside the array. Although the CWE is listed as N/A, this is a classic out-of-bounds access (CWE-125/CWE-787 family), consistent with the input's 'Buffer Overflow' tag. Root cause is untrusted, server-controlled response framing being indexed without a correct/bounded mapping.

Affected ProductsAI

The affected product is the mainline Linux kernel, specifically the in-kernel SMB client (cifs/smb-client) code in fs/smb/client where smb2_compound_op() resides. No specific vendor CPE list or exact version range was provided in the input; affected versions are those carrying the buggy indexing prior to the stable fixes. The fix is distributed across stable-tree commits at git.kernel.org: 093615fc76063ea08d454ba86677ce64c736e806, ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5, bfb1e2aad1fecef8320fd71332acde0d53a8d699, and fbe2dc6a9c7318f7263f5e4d50f6272b931c5756, indicating multiple maintained stable branches received backports. Consult your distribution's kernel advisory to map these commits to a packaged kernel build version for your specific release.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update from your distribution that incorporates the stable commits (093615fc7606, ba7bcfd52c66, bfb1e2aad1fe, fbe2dc6a9c73 at git.kernel.org/stable) and reboot, since the fix corrects the response-buffer indexing in smb2_compound_op(). If you cannot patch immediately, reduce exposure by ensuring hosts only mount SMB shares from trusted, authenticated servers, enforce SMB signing/encryption (seal) to prevent man-in-the-middle response tampering, and restrict outbound/inbound SMB (TCP 445) to known file servers via firewall rules - note the trade-off that mandatory signing/encryption adds CPU overhead and blocking 445 breaks legitimate cross-network share access. On systems that never mount remote SMB shares, blacklisting/unloading the cifs kernel module removes the attack surface entirely, at the cost of losing SMB client functionality.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2025-39975 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy