Skip to main content

Linux Kernel ksmbd CVE-2025-40084

HIGH
2025-10-29 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
5.1 MEDIUM

Trigger comes from the root-run ksmbd.mountd IPC peer, so PR:H; the over-read is bounded to 4 bytes (C:L) while a bad dereference can fault the kernel (A:H).

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:44 vuln.today
CVE Published
Oct 29, 2025 - 14:15 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: transport_ipc: validate payload size before reading handle

handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Validate the size before dereferencing.

This is a minimal fix to guard the initial handle read.

AnalysisAI

Out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB server allows a 4-byte read past a declared IPC payload boundary when handle_response() in transport_ipc.c dereferences a message handle without first validating that the payload is at least 4 bytes long. The flaw is triggered by a malformed or truncated message from the userspace ksmbd.mountd helper, potentially leaking a small amount of adjacent kernel memory or crashing the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.19% (9th percentile).

Technical ContextAI

ksmbd is the Linux kernel's in-kernel SMB3 file server, which cooperates with a privileged userspace daemon (ksmbd.mountd) over a netlink/IPC channel for management operations such as user and share resolution. The affected code, handle_response() in fs/smb/server/transport_ipc.c, receives response messages from ksmbd.mountd and immediately interprets the first 4 bytes of the payload as an integer handle used to correlate the response with a pending request. Because the declared payload size is not checked against the minimum 4 bytes before the dereference, a short message causes a read beyond the intended payload - a classic out-of-bounds read (CWE-125), even though NVD lists the CWE as N/A. The tag 'Information Disclosure' reflects that the primary risk is leakage of adjacent kernel memory, with a secondary risk of an invalid access causing a fault.

Affected ProductsAI

The affected product is the Linux kernel, specifically the ksmbd in-kernel SMB server component (fs/smb/server/transport_ipc.c). NVD does not publish explicit fixed version numbers here; instead, five stable-tree fix commits are referenced (git.kernel.org commits 2dc125f5da134c0915a840b62565c60a595673dd, 6f40e50ceb99fc8ef37e5c56e2ec1d162733fef0, 867ffd9d67285612da3f0498ca618297f8e41f01, 898d527ed94c19980a4d848f10057f1fed578ffb, and a02e432d5130da4c723aabe1205bac805889fdb2), indicating backports across multiple stable branches. Only kernels built with ksmbd (CONFIG_SMB_SERVER) and actually running the ksmbd server are exposed; no CPE strings were supplied in the input to pin exact version ranges.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the stable-tree commits referenced by NVD (e.g. git.kernel.org/stable/c/2dc125f5da134c0915a840b62565c60a595673dd and the four sibling commits) or update to your distribution's kernel package that incorporates them. As a compensating control until patched, unload or disable the ksmbd server (stop the ksmbd service and prevent the ksmbd kernel module from loading, or build without CONFIG_SMB_SERVER) if SMB serving is not required - the trade-off is loss of in-kernel SMB file-sharing functionality. Because the malformed message must come from ksmbd.mountd, also ensure the ksmbd.mountd userspace daemon and its binary/permissions are not tamperable by unprivileged users, reducing the chance that a compromised helper can drive the truncated-message path.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-40084 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy