CVE-2025-21994

ksmbd: fix incorrect validation for num_aces field of smb_acl

MEDIUM

5.5

CVSS Score

Published: April 2, 2025 at 02:00 PM UTC

Updated: August 5, 2026 at 12:44 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix incorrect validation for num_aces field of smb_acl parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an incorrect validation that we can create an array of size ULONG_MAX. smb_acl has ->size field to calculate actual number of aces in request buffer size. Use this to check invalid num_aces.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.15 ≤ v < 5.15.1805.15 ≤ v < 6.1.1325.15 ≤ v < 6.12.215.15 ≤ v < 6.13.95.15 ≤ v < 6.145.15 ≤ v < 6.6.855.16 ≤ v < 6.1.1326.13 ≤ v < 6.13.96.2 ≤ v < 6.6.856.7 ≤ v < 6.12.216.14 rc1 6.14 rc2 6.14 rc3 6.14 rc4 6.14 rc5626e6641f6b467447c81dd7678a69c66f7746cf

Vendor states this is fixed in 1b8b67f3c5e5169535e26efedd3e422172e2db64 (fixed)

Vendor states this is fixed in 9c4e202abff45f8eac17989e549fc7a75095f675 (fixed)

Vendor states this is fixed in a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd (fixed)

Vendor states this is fixed in c3a3484d9d31b27a3db0fab91fcf191132d65236 (fixed)

Vendor states this is fixed in d0f87370622a853b57e851f7d5a5452b72300f19 (fixed)

Vendor states this is fixed in f6a6721802ac2f12f4c1bbe839a4c229b61866f2 (fixed)

Vendor states this is fixed in 5.15 (unaffected)

Vendor states this is fixed in 5.15.180 (unaffected)

Vendor states this is fixed in 6.1.132 (unaffected)

Vendor states this is fixed in 6.12.21 (unaffected)

Vendor states this is fixed in 6.13.9 (unaffected)

Vendor states this is fixed in 6.14 (unaffected)