CVE-2025-39943 (GCVE-0-2025-39943)
Vulnerability from cvelistv5
Published
2025-10-04 07:31
Modified
2026-08-05 12:06
Severity ?
9.4 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2ea086e35c3d726a3bacd0a971c1f02a50e98206
Version: 2ea086e35c3d726a3bacd0a971c1f02a50e98206
Version: 2ea086e35c3d726a3bacd0a971c1f02a50e98206
Version: 2ea086e35c3d726a3bacd0a971c1f02a50e98206
Version: 2ea086e35c3d726a3bacd0a971c1f02a50e98206
Version: 2ea086e35c3d726a3bacd0a971c1f02a50e98206
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/transport_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "773fddf976d282ef059c36c575ddb81567acd6bc",
              "status": "affected",
              "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
              "versionType": "git"
            },
            {
              "lessThan": "bdaab5c6538e250a9654127e688ecbbeb6f771d5",
              "status": "affected",
              "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
              "versionType": "git"
            },
            {
              "lessThan": "eb0378dde086363046ed3d7db7f126fc3f76fd70",
              "status": "affected",
              "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
              "versionType": "git"
            },
            {
              "lessThan": "8be498fcbd5b07272f560b45981d4b9e5a2ad885",
              "status": "affected",
              "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
              "versionType": "git"
            },
            {
              "lessThan": "529b121b00a6ee3c88fb3c01b443b2b81f686d48",
              "status": "affected",
              "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
              "versionType": "git"
            },
            {
              "lessThan": "5282491fc49d5614ac6ddcd012e5743eecb6a67c",
              "status": "affected",
              "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/transport_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.154",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer\n\nIf data_offset and data_length of smb_direct_data_transfer struct are\ninvalid, out of bounds issue could happen.\nThis patch validate data_offset and data_length field in recv_done."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server and this code parses the SMB Direct data-transfer header received from a remote peer over RDMA (iWARP/RoCEv2 are routable over ordinary IP networks, and soft-iWARP/soft-RoCE expose it without special hardware). The attacker only needs to reach the SMB Direct listener.\nAC:L - The attacker simply completes the SMBD negotiate handshake and sends one data-transfer message with an arbitrary data_offset field; no race, no memory-layout precondition, and the trigger is fully deterministic and repeatable.\nPR:N - The vulnerable memcpy executes on the very first SMB2 PDU read by ksmbd_conn_handler_loop, i.e. before SMB2 NEGOTIATE and SESSION_SETUP, so no SMB credentials or authentication are required. Only the transport-level SMBD negotiate, which is unauthenticated, precedes it.\nUI:N - The server processes the malicious SMB Direct packet automatically in its receive completion and connection handler paths. No local user or administrator action is involved.\nS:U - The out-of-bounds access and its consequences are confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unvalidated 32-bit data_offset lets a remote unauthenticated peer read up to ~8 KB from any offset within 4 GiB of an 8 KB slab object, and the leaked bytes are installed as the SMB2 request whose header fields are echoed back in responses, yielding a repeatable byte-granular kernel memory disclosure oracle.\nI:L - There is no out-of-bounds write, but the server assembles and dispatches an SMB2 request built from out-of-bounds kernel memory, so connection and request-handling state is driven by data the attacker caused it to read from outside the intended buffer.\nA:H - A large data_offset makes the memcpy read unmapped memory, vmalloc guard pages, or memory past the end of the direct map, faulting in kernel context and producing an oops (a full panic with panic_on_oops) and tearing down the ksmbd connection handler thread."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:18.093Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/773fddf976d282ef059c36c575ddb81567acd6bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdaab5c6538e250a9654127e688ecbbeb6f771d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb0378dde086363046ed3d7db7f126fc3f76fd70"
        },
        {
          "url": "https://git.kernel.org/stable/c/8be498fcbd5b07272f560b45981d4b9e5a2ad885"
        },
        {
          "url": "https://git.kernel.org/stable/c/529b121b00a6ee3c88fb3c01b443b2b81f686d48"
        },
        {
          "url": "https://git.kernel.org/stable/c/5282491fc49d5614ac6ddcd012e5743eecb6a67c"
        }
      ],
      "title": "ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39943",
    "datePublished": "2025-10-04T07:31:05.581Z",
    "dateReserved": "2025-04-16T07:20:57.148Z",
    "dateUpdated": "2026-08-05T12:06:18.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.