CVE-2025-40084

ksmbd: transport_ipc: validate payload size before reading handle

State: Published
Severity: 7.1 High
Published: Oct 29, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: transport_ipc: validate payload size before reading handle

handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Validate the size before dereferencing.

This is a minimal fix to guard the initial handle read.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0626e6641f6b467447c81dd7678a69c66f7746cf to before a02e432d5130da4c723aabe1205bac805889fdb2Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 2dc125f5da134c0915a840b62565c60a595673ddAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 898d527ed94c19980a4d848f10057f1fed578ffbAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 867ffd9d67285612da3f0498ca618297f8e41f01Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 6f40e50ceb99fc8ef37e5c56e2ec1d162733fef0Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.158 through 6.1.Not affected 6.6.115 through 6.6.Not affected 6.12.56 through 6.12.Not affected 6.17.6 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

0626e6641f6b467447c81dd7678a69c66f7746cf to before a02e432d5130da4c723aabe1205bac805889fdb2Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 2dc125f5da134c0915a840b62565c60a595673ddAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 898d527ed94c19980a4d848f10057f1fed578ffbAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 867ffd9d67285612da3f0498ca618297f8e41f01Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 6f40e50ceb99fc8ef37e5c56e2ec1d162733fef0Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.158 through 6.1.*Not affected
6.6.115 through 6.6.*Not affected
6.12.56 through 6.12.*Not affected
6.17.6 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.