CVE-2025-39943

ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer

HIGH

7.1

CVSS Score

Published: October 4, 2025 at 07:31 AM UTC

Updated: October 19, 2026 at 09:10 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.1

Exploit prediction

EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.15.1 ≤ v < 5.15.1945.16 ≤ v < 6.1.1546.13 ≤ v < 6.16.96.2 ≤ v < 6.6.1086.7 ≤ v < 6.12.492ea086e35c3d726a3bacd0a971c1f02a50e982065.15 5.15 rc7 6.17 6.17 rc1 6.17 rc2 6.17 rc3 6.17 rc4 6.17 rc5 6.17 rc6

Vendor states this is fixed in 5282491fc49d5614ac6ddcd012e5743eecb6a67c (fixed)

Vendor states this is fixed in 529b121b00a6ee3c88fb3c01b443b2b81f686d48 (fixed)

Vendor states this is fixed in 773fddf976d282ef059c36c575ddb81567acd6bc (fixed)

Vendor states this is fixed in 8be498fcbd5b07272f560b45981d4b9e5a2ad885 (fixed)

Vendor states this is fixed in bdaab5c6538e250a9654127e688ecbbeb6f771d5 (fixed)

Vendor states this is fixed in eb0378dde086363046ed3d7db7f126fc3f76fd70 (fixed)

Vendor states this is fixed in 5.15 (unaffected)

Vendor states this is fixed in 5.15.194 (unaffected)

Vendor states this is fixed in 6.1.154 (unaffected)

Vendor states this is fixed in 6.12.49 (unaffected)

Vendor states this is fixed in 6.16.9 (unaffected)

Vendor states this is fixed in 6.17 (unaffected)