CVE-2025-22037

ksmbd: fix null pointer dereference in alloc_preauth_hash()

State: Published
Severity: 7.5 High
Published: Apr 16, 2025
Updated: Oct 30, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix null pointer dereference in alloc_preauth_hash()

The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0626e6641f6b467447c81dd7678a69c66f7746cf to before 2d3461d6ae74ebdcd4d65128c855198649bcadcdAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before cce57cd8c5dead24127cf2308fdd60fcad2d6ba6Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before ca8bed31edf728a662ef9d6f39f50e7a7dc2b5adAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 8f216b33a5e1b3489c073b1ea1b3d7cb63c8dc4dAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before b8eb243e670ecf30e91524dd12f7260dac07d335Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.107 through 6.6.Not affected 6.12.23 through 6.12.Not affected 6.13.11 through 6.13.Not affected 6.14.2 through 6.14.*Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

0626e6641f6b467447c81dd7678a69c66f7746cf to before 2d3461d6ae74ebdcd4d65128c855198649bcadcdAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before cce57cd8c5dead24127cf2308fdd60fcad2d6ba6Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before ca8bed31edf728a662ef9d6f39f50e7a7dc2b5adAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 8f216b33a5e1b3489c073b1ea1b3d7cb63c8dc4dAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before b8eb243e670ecf30e91524dd12f7260dac07d335Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.107 through 6.6.*Not affected
6.12.23 through 6.12.*Not affected
6.13.11 through 6.13.*Not affected
6.14.2 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.