Riskcovery

CVE-2025-39943

ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer

State
Published
Severity
9.4 Critical
Published
Oct 4, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer

If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done.

Scores

CVSSScoreVectorSource
3.19.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 2ea086e35c3d726a3bacd0a971c1f02a50e98206 to before 773fddf976d282ef059c36c575ddb81567acd6bcAffected
  • 2ea086e35c3d726a3bacd0a971c1f02a50e98206 to before bdaab5c6538e250a9654127e688ecbbeb6f771d5Affected
  • 2ea086e35c3d726a3bacd0a971c1f02a50e98206 to before eb0378dde086363046ed3d7db7f126fc3f76fd70Affected
  • 2ea086e35c3d726a3bacd0a971c1f02a50e98206 to before 8be498fcbd5b07272f560b45981d4b9e5a2ad885Affected
  • 2ea086e35c3d726a3bacd0a971c1f02a50e98206 to before 529b121b00a6ee3c88fb3c01b443b2b81f686d48Affected
  • 2ea086e35c3d726a3bacd0a971c1f02a50e98206 to before 5282491fc49d5614ac6ddcd012e5743eecb6a67cAffected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 5.15.194 through 5.15.*Not affected
  • 6.1.154 through 6.1.*Not affected
  • 6.6.108 through 6.6.*Not affected
  • 6.12.49 through 6.12.*Not affected
  • 6.16.9 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.