Riskcovery

CVE-2025-22038

ksmbd: validate zero num_subauth before sub_auth is accessed

State
Published
Severity
8.3 High
Published
Apr 16, 2025
Updated
Aug 5, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate zero num_subauth before sub_auth is accessed

Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-bounds read. This patch adds a validation step to ensure num_subauth != 0 before sub_auth is accessed.

Scores

CVSSScoreVectorSource
3.18.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:HLinux
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 3ac65de111c686c95316ade660f8ba7aea3cd3ccAffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 0e36a3e080d6d8bd7a34e089345d043da4ac8283Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 56de7778a48560278c334077ace7b9ac4bfb2fd1Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 68c6c3142bfcdb049839d40a9a59ebe8ea865002Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before c8bfe1954a0b89e7b29b3a3e7f4c5e0ebd295e20Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before bf21e29d78cd2c2371023953d9c82dfef82ebb36Affected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 6.1.134 through 6.1.*Not affected
  • 6.6.87 through 6.6.*Not affected
  • 6.12.23 through 6.12.*Not affected
  • 6.13.11 through 6.13.*Not affected
  • 6.14.2 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.