CVE-2025-39942

ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size

MEDIUM

5.5

CVSS Score

Published: October 4, 2025 at 07:31 AM UTC

Updated: October 19, 2026 at 09:10 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size This is inspired by the check for data_offset + data_length.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.15.1 ≤ v < 6.1.1546.13 ≤ v < 6.16.96.2 ≤ v < 6.6.1086.7 ≤ v < 6.12.492ea086e35c3d726a3bacd0a971c1f02a50e982065.15 5.15 rc7 6.17 6.17 rc1 6.17 rc2 6.17 rc3 6.17 rc4 6.17 rc5 6.17 rc6

Vendor states this is fixed in 196a3a7676d726ee67621ea2bf3b7815ac2685b4 (fixed)

Vendor states this is fixed in 9644798294c7287e65a7b26e35aa6d2ce3345bcc (fixed)

Vendor states this is fixed in c64b915bb3d9339adcae5db4be2c35ffbef5e615 (fixed)

Vendor states this is fixed in d3cb3f209d35c44b7ee74f77ed27ebb28995b9ce (fixed)

Vendor states this is fixed in e1868ba37fd27c6a68e31565402b154beaa65df0 (fixed)

Vendor states this is fixed in 5.15 (unaffected)

Vendor states this is fixed in 6.1.154 (unaffected)

Vendor states this is fixed in 6.12.49 (unaffected)

Vendor states this is fixed in 6.16.9 (unaffected)

Vendor states this is fixed in 6.17 (unaffected)

Vendor states this is fixed in 6.6.108 (unaffected)