Executive brief
A vulnerability exists in the Linux kernel's ksmbd component, which provides file-sharing services (SMB) over high-speed RDMA networks. An attacker could exploit this flaw to cause a system crash or potentially access sensitive information by sending specially crafted network packets. This could lead to service outages or unauthorized data exposure in environments using high-performance storage networking.
Technical details
An out-of-bounds (OOB) vulnerability exists in the ksmbd (SMB3 server) component of the Linux kernel, specifically within the SMB Direct (RDMA) transport implementation. The root cause is a failure to properly validate the 'data_offset' and 'data_length' fields in the 'smb_direct_data_transfer' structure during packet processing in 'recv_done'. A remote, unauthenticated attacker can provide malicious offset or length values that exceed the allocated buffer size, leading to an OOB access. This can result in a denial of service (kernel crash) or information disclosure. Patches have been released for multiple stable kernel branches including 5.15.x, 6.1.x, 6.6.x, 6.12.x, and 6.16.x.
Affected products
- Linux Linux Kernel 5.15 to 5.15.194, 6.1 to 6.1.154, 6.6 to 6.6.108, 6.12 to 6.12.49, 6.13 to 6.16.9
Timeline
- 2025-09-10: patched: Initial patch authored by Namjae Jeon
- 2025-10-04: disclosed: CVE published
References
- https://git.kernel.org/stable/c/5282491fc49d5614ac6ddcd012e5743eecb6a67c
- https://git.kernel.org/stable/c/529b121b00a6ee3c88fb3c01b443b2b81f686d48
- https://git.kernel.org/stable/c/773fddf976d282ef059c36c575ddb81567acd6bc
- https://git.kernel.org/stable/c/8be498fcbd5b07272f560b45981d4b9e5a2ad885
- https://git.kernel.org/stable/c/bdaab5c6538e250a9654127e688ecbbeb6f771d5
- https://git.kernel.org/stable/c/eb0378dde086363046ed3d7db7f126fc3f76fd70