CVE-2025-22039

ksmbd: fix overflow in dacloffset bounds check

State: Published
Severity: 8.8 High
Published: Apr 16, 2025
Updated: Sep 14, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix overflow in dacloffset bounds check

The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smb_check_perm_dacl() and smb_inherit_dacl().

This could result in out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer.

This patch converts dacloffset to unsigned int and uses check_add_overflow() to validate access to the DACL.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0626e6641f6b467447c81dd7678a69c66f7746cf to before abbb4ec41867f2cd1c971258e493893bf43bcbd3Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 8483d7b532be1d1bc149556a2fedf903868c6303Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 73f074fb5e139cd42ad75089abe4e28a49a30003Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dcAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 6b8d379048b168a0dff5ab1acb975b933f368514Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 443b373a4df5a2cb9f7b8c4658b2afedeb16397fAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.23 through 6.12.Not affected 6.13.11 through 6.13.Not affected 6.14.2 through 6.14.Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

0626e6641f6b467447c81dd7678a69c66f7746cf to before abbb4ec41867f2cd1c971258e493893bf43bcbd3Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 8483d7b532be1d1bc149556a2fedf903868c6303Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 73f074fb5e139cd42ad75089abe4e28a49a30003Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dcAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 6b8d379048b168a0dff5ab1acb975b933f368514Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 443b373a4df5a2cb9f7b8c4658b2afedeb16397fAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.23 through 6.12.*Not affected
6.13.11 through 6.13.*Not affected
6.14.2 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.