CVE-2025-39933

smb: client: let recv_done verify data_offset, data_length and remaining_data_length

State: Published
Severity: 9.4 Critical
Published: Oct 4, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: let recv_done verify data_offset, data_length and remaining_data_length

This is inspired by the related server fixes.

Scores

CVSS	Score	Vector	Source
3.1	9.4 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f198186aa9bbd60fae7a2061f4feec614d880299 to before fdc23a47be015fba915c4f9dfd43c65ad4829a35Affected f198186aa9bbd60fae7a2061f4feec614d880299 to before f23d5c6b7540ec9b1e73a8ea3b2ae9045248d728Affected f198186aa9bbd60fae7a2061f4feec614d880299 to before 241e58de23e7c1bbb9bee526c17d9a0f2a90fbadAffected f198186aa9bbd60fae7a2061f4feec614d880299 to before 581fb78e0388b78911b0c920e4073737090c8b5fAffected f198186aa9bbd60fae7a2061f4feec614d880299 to before f57e53ea252363234f86674db475839e5b87102eAffected
LinuxLinux	4.16Affected before 4.16Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.16.9 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

f198186aa9bbd60fae7a2061f4feec614d880299 to before fdc23a47be015fba915c4f9dfd43c65ad4829a35Affected
f198186aa9bbd60fae7a2061f4feec614d880299 to before f23d5c6b7540ec9b1e73a8ea3b2ae9045248d728Affected
f198186aa9bbd60fae7a2061f4feec614d880299 to before 241e58de23e7c1bbb9bee526c17d9a0f2a90fbadAffected
f198186aa9bbd60fae7a2061f4feec614d880299 to before 581fb78e0388b78911b0c920e4073737090c8b5fAffected
f198186aa9bbd60fae7a2061f4feec614d880299 to before f57e53ea252363234f86674db475839e5b87102eAffected

LinuxLinux

4.16Affected
before 4.16Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.16.9 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.