Executive brief
A vulnerability exists in the Linux kernel's SMB client (CIFS) that could allow a malicious file server to crash a connected system or potentially access sensitive memory. The issue occurs when the system processes specially crafted responses from a network file share. Organizations using Linux to connect to remote SMB/CIFS file shares should apply kernel updates to prevent potential service disruptions or data exposure.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the parse_dfs_referrals function within fs/smb/client/misc.c of the Linux kernel. The flaw is triggered when a malicious SMB server responds to an FSCTL_DFS_GET_REFERRALS request with a payload smaller than the expected structure size or a referral count that exceeds the actual buffer size. An attacker controlling a remote SMB server can exploit this to cause a kernel oops or potentially leak kernel memory. The issue has been resolved by adding proper bounds checking to validate the response size and referral count against the received buffer length. Patches are available in stable kernel branches including 6.1.158, 6.6.114, 6.12.55, and 6.17.5.
Affected products
- Linux Linux Kernel 4.11 to 6.17.4
Timeline
- 2025-10-13: other: Vulnerability fixed in kernel source
- 2025-10-30: disclosed: CVE published
References
- https://git.kernel.org/stable/c/15c73964da9df994302f579ed14ee5fdbce7a332
- https://git.kernel.org/stable/c/6447b0e355562a1ff748c4a2ffb89aae7e84d2c9
- https://git.kernel.org/stable/c/8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058
- https://git.kernel.org/stable/c/bb0f2e66e1ac043a5b238f5bcab4f26f3c317039
- https://git.kernel.org/stable/c/cfacc7441f760e4a73cc71b6ff1635261d534657