CVE-2025-21994 (GCVE-0-2025-21994)
Vulnerability from cvelistv5
Published
2025-04-02 14:00
Modified
2026-08-05 11:55
Severity ?
7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix incorrect validation for num_aces field of smb_acl parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an incorrect validation that we can create an array of size ULONG_MAX. smb_acl has ->size field to calculate actual number of aces in request buffer size. Use this to check invalid num_aces.
References
Impacted products
Vendor Product Version
Linux Linux Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:40:35.107Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c3a3484d9d31b27a3db0fab91fcf191132d65236",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "9c4e202abff45f8eac17989e549fc7a75095f675",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "d0f87370622a853b57e851f7d5a5452b72300f19",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "f6a6721802ac2f12f4c1bbe839a4c229b61866f2",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "1b8b67f3c5e5169535e26efedd3e422172e2db64",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.85",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.21",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.9",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix incorrect validation for num_aces field of smb_acl\n\nparse_dcal() validate num_aces to allocate posix_ace_state_array.\n\nif (num_aces \u003e ULONG_MAX / sizeof(struct smb_ace *))\n\nIt is an incorrect validation that we can create an array of size ULONG_MAX.\nsmb_acl has -\u003esize field to calculate actual number of aces in request buffer\nsize. Use this to check invalid num_aces."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445, and the malformed `num_aces`/DACL arrives directly in an SMB2_SET_INFO (SMB2_O_INFO_SECURITY) or SMB2_CREATE SD_BUFFER request payload. No local access to the target is needed at any point.\nAC:L - The attacker simply sets the 16/32-bit `num_aces` field of the DACL header to a large value while keeping `pdacl-\u003esize` minimal; the oversized allocations follow deterministically on the first request with no race, no memory-layout dependency, and no non-default configuration beyond ksmbd being enabled.\nPR:L - `smb2_set_info()` is reached only after SMB2 session setup, and it additionally requires `KSMBD_TREE_CONN_FLAG_WRITABLE` on the tree connect plus a valid file handle, so any ordinary share account (or the guest account where the share permits it) suffices \u2014 but unauthenticated access does not.\nUI:N - The attacker completes the session setup, tree connect, open and SET_INFO sequence entirely on its own. No administrator or client-side victim action is involved.\nS:U - The oversized allocations and the misparsed ACL stay entirely within the kernel\u0027s own security authority on the SMB server host; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:L - The same commit removes a `sid.sub_auth[num_subauth - 1]` negative-index read that, with `num_subauth == 0`, reads the four bytes preceding `sub_auth` and feeds them to `sid_to_id()` and the group-SID test. The read is strictly bounded to 4 bytes that lie inside the client\u0027s own request buffer (`end_of_acl` is validated by `ksmbd_smb2_check_message()`), so it is a limited misread rather than an arbitrary kernel-memory disclosure.\nI:L - `parse_dacl()`\u0027s output is applied to the file through `set_posix_acl()` and `notify_change()` in `set_info_sec()`, so an ACL parsed from an unvalidated ACE count and an out-of-bounds `sub_auth[-1]` value yields on-disk permissions and uid/gid mappings that do not correspond to the descriptor sent. This is bounded metadata corruption on files the attacker can already write; the `num_aces`-sized `ppace` and `posix_ace_state_array` writes remain in bounds and the `init_acl_state()` `int` truncation is unreachable because the paired `kmalloc_array()` fails first, so there is no arbitrary-write primitive.\nA:H - A ~120-byte request forces up to ~19 MB of high-order `GFP_KERNEL` allocations (4 \u00d7 ~4 MB `posix_ace_state_array` plus ~2.8 MB `ppace`), a ~200,000\u00d7 amplification, and ksmbd\u0027s 256-slot `ksmbd-io` workqueue lets a few connections drive gigabytes of concurrent order-8/order-10 allocation pressure \u2014 producing direct-reclaim/compaction stalls, page-allocation-failure splats (fatal under `panic_on_warn`), and OOM kills that take down the host, which is especially severe on the NAS, router, and embedded devices where ksmbd is commonly deployed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:53.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c3a3484d9d31b27a3db0fab91fcf191132d65236"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c4e202abff45f8eac17989e549fc7a75095f675"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0f87370622a853b57e851f7d5a5452b72300f19"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6a6721802ac2f12f4c1bbe839a4c229b61866f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b8b67f3c5e5169535e26efedd3e422172e2db64"
        }
      ],
      "title": "ksmbd: fix incorrect validation for num_aces field of smb_acl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21994",
    "datePublished": "2025-04-02T14:00:37.407Z",
    "dateReserved": "2024-12-29T08:45:45.801Z",
    "dateUpdated": "2026-08-05T11:55:53.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.