Junglewise Threat Intelligence

CVE-2025-40084: Linux Kernel ksmbd out-of-bounds read in transport_ipc

CVE-2025-40084 · Severity: high · CVSS 7.1 · Published 2025-10-29

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's SMB server component (ksmbd), which is used to share files over a network. A local attacker could send a specially crafted message to the server to trigger an unauthorized memory read. This could lead to a system crash or the exposure of sensitive information from the computer's memory.

Technical details

An out-of-bounds read vulnerability exists in the ksmbd SMB server in the Linux kernel, specifically within the handle_response() function in fs/smb/server/transport_ipc.c. The function dereferences a 4-byte handle from the IPC payload without first verifying that the payload size (sz) is at least 4 bytes. A local attacker or a compromised ksmbd.mountd process could provide a truncated message, causing the kernel to read 4 bytes beyond the allocated buffer. This flaw can be exploited to leak kernel memory or cause a kernel oops (denial of service). The issue has been resolved by adding a size validation check before the handle is dereferenced.

Affected products

  • Linux Linux Kernel 5.15 to 6.17.6

Timeline

  • 2025-10-22: disclosed: Vulnerability reported by Qianchang Zhao
  • 2025-10-29: patched: Fixes committed to stable kernel branches
  • 2025-10-29: advisory: CVE-2025-40084 published

References

Related threats