CVE-2025-37956

ksmbd: prevent rename with empty string

State: Published
Severity: 8.8 High
Published: May 20, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: prevent rename with empty string

Client can send empty newname string to ksmbd server. It will cause a kernel oops from d_alloc. This patch return the error when attempting to rename a file or directory with an empty new name string.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0626e6641f6b467447c81dd7678a69c66f7746cf to before 35e2964e93d95185d2db0c0ffd9959d0197b3956Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 6ee551672c8cf36108b0cfba92ec0c7c28ac3439Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before c57301e332cc413fe0a7294a90725f4e21e9549dAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before d7f2c00acb1ef64304fd40ac507e9213ff1d9b5cAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 53e3e5babc0963a92d856a5ec0ce92c59f54bc12Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.91 through 6.6.Not affected 6.12.29 through 6.12.Not affected 6.14.7 through 6.14.Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

0626e6641f6b467447c81dd7678a69c66f7746cf to before 35e2964e93d95185d2db0c0ffd9959d0197b3956Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 6ee551672c8cf36108b0cfba92ec0c7c28ac3439Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before c57301e332cc413fe0a7294a90725f4e21e9549dAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before d7f2c00acb1ef64304fd40ac507e9213ff1d9b5cAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 53e3e5babc0963a92d856a5ec0ce92c59f54bc12Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.91 through 6.6.*Not affected
6.12.29 through 6.12.*Not affected
6.14.7 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.