Skip to main content

Linux Kernel CVE-2025-40099

CRITICAL
2025-10-30 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.4 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.4 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
vuln.today AI
6.8 MEDIUM

Client must be induced to connect to a malicious SMB server (UI:R, AC:H); OOB read yields memory disclosure (C:H) and crash (A:H) with no integrity write (I:N).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:39 vuln.today
CVE Published
Oct 30, 2025 - 10:15 cve.org
CRITICAL 9.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

cifs: parse_dfs_referrals: prevent oob on malformed input

Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS

  • reply smaller than sizeof(struct get_dfs_referral_rsp)
  • reply with number of referrals smaller than NumberOfReferrals in the

header

Processing of such replies will cause oob.

Return -EINVAL error on such replies to prevent oob-s.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) allows a malicious or compromised SMB server to trigger memory corruption on connecting clients by returning a malformed FSCTL_DFS_GET_REFERRALS reply. The flaw affects Linux systems that mount SMB/CIFS shares and process DFS referrals, where a reply shorter than struct get_dfs_referral_rsp or claiming more referrals than it contains drives reads past the buffer. No public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with a client-side, server-triggered condition rather than mass-exploitable exposure.

Technical ContextAI

The vulnerability lives in the kernel's cifs client code that parses Distributed File System (DFS) referral responses. When a client requests DFS referrals via the FSCTL_DFS_GET_REFERRALS SMB IOCTL, parse_dfs_referrals interprets the server's get_dfs_referral_rsp structure, including a NumberOfReferrals header field. Because the code trusted the server-supplied length and referral count without validating them against the actual reply size, a reply smaller than sizeof(struct get_dfs_referral_rsp), or one whose NumberOfReferrals exceeds the referrals actually present, causes the parser to read beyond the allocated buffer. This is an out-of-bounds read class defect (CWE-125-style, though CWE is listed N/A in the source data); the fix returns -EINVAL on such malformed replies. Exploitation is inherently client-side: the kernel acts as the SMB client trusting a remote server's response.

Affected ProductsAI

The Linux kernel's CIFS/SMB client subsystem is affected on versions prior to the stable fixes; exact affected version ranges are not enumerated in the provided data (CWE and NVD CPE ranges were not supplied). The fix is distributed across multiple stable-branch commits published on git.kernel.org (15c73964da9df994302f579ed14ee5fdbce7a332, 6447b0e355562a1ff748c4a2ffb89aae7e84d2c9, 8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058, bb0f2e66e1ac043a5b238f5bcab4f26f3c317039, cfacc7441f760e4a73cc71b6ff1635261d534657), indicating backports to several maintained kernel series. Any distribution kernel that builds the cifs module and mounts SMB/DFS shares should be considered in scope until the corresponding vendor kernel update is confirmed.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor kernel update that incorporates the stable commits listed at git.kernel.org (e.g. 15c73964da9df994302f579ed14ee5fdbce7a332 and the four sibling backports) as soon as your distribution ships them, then reboot to load the patched kernel. Until patched, restrict CIFS mounts to trusted, authenticated SMB servers only and avoid mounting shares from untrusted networks; where DFS is not required, mount with the 'nodfs' option to bypass the vulnerable referral-parsing path, accepting the trade-off that DFS namespace resolution will not function. Enforce SMB signing and, where possible, encryption to reduce man-in-the-middle downgrade/injection of malicious referral replies, and network-segment or firewall client egress to port 445 so hosts cannot reach arbitrary external SMB servers, noting this may block legitimate remote share access.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.105 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.124 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.90 Affected

Share

CVE-2025-40099 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy