CVE-2025-21947

The CVE-2025-21947 issue affects the Linux kernel ksmbd subsystem and is resolved by a fix for a race condition that can cause type confusion in IPC message handling. Root cause: req->handle is allocated via ksmbd_acquire_id(&ipc_ida) (ida_alloc) and can be reused for ksmbd_ipc_login_request a...

CVE-2025-21947

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipcmsgsendrequest req-handle is allocated using ksmbdacquireid&ipcida, based on idaalloc. req-handle from ksmbdipcloginrequest and FSCTLPIPETRANSCEIVE ioctl can be same and ...

CVE-2025-21947 ksmbd: fix type confusion via race condition when using ipc_msg_send_request

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipcmsgsendrequest req-handle is allocated using ksmbdacquireid&ipcida, based on idaalloc. req-handle from ksmbdipcloginrequest and FSCTLPIPETRANSCEIVE ioctl can be same and ...

CVE-2025-21945 ksmbd: fix use-after-free in smb2_lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2lock If smblock-zerolen has value, -llist of smblock is not delete and flock is old one. It will cause use-after-free on error handling routine...

CVE-2025-21946

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parsesecdesc If osidoffset, gsidoffset and dacloffset could be greater than smbntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when validating sid, It need to check it includ...

CVE-2025-21946 ksmbd: fix out-of-bounds in parse_sec_desc()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parsesecdesc If osidoffset, gsidoffset and dacloffset could be greater than smbntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when validating sid, It need to check it includ...

CVE-2025-21945 ksmbd: fix use-after-free in smb2_lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2lock If smblock-zerolen has value, -llist of smblock is not delete and flock is old one. It will cause use-after-free on error handling routine...

CVE-2025-21946

The CVE-2025-21946 entry affects the Linux kernel ksmbd component; the issue is a slab-out-of-bounds in parse_sec_desc() caused by offsets (osidoffset, gsidoffset, dacloffset) exceeding the smb_ntsd structure, and by not verifying the subauth array size when validating a SID. The connected Astra ...

CVE-2025-21945

CVE-2025-21945 affects the Linux kernel (ksmbd) with a use-after-free in smb2_lock. The issue occurs when smb_lock->zero_len is non-zero, causing the ->llist of smb_lock not to be deleted and the flock to reference a freed object during error handling. This is described in the Azure Linux 3...

CVE-2025-21945

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2lock If smblock-zerolen has value, -llist of smblock is not delete and flock is old one. It will cause use-after-free on error handling routine...

CVE-2025-21945 ksmbd: fix use-after-free in smb2_lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2lock If smblock-zerolen has value, -llist of smblock is not delete and flock is old one. It will cause use-after-free on error handling routine...

CVE-2025-21944 ksmbd: fix bug on trap in smb2_lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix bug on trap in smb2lock If lock count is greater than 1, flags could be old value. It should be checked with flags of smblock, not flags. It will cause bug-on trap from locksfreelock in error handling routine...

CVE-2025-21944

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix bug on trap in smb2lock If lock count is greater than 1, flags could be old value. It should be checked with flags of smblock, not flags. It will cause bug-on trap from locksfreelock in error handling routine...

CVE-2025-21944 ksmbd: fix bug on trap in smb2_lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix bug on trap in smb2lock If lock count is greater than 1, flags could be old value. It should be checked with flags of smblock, not flags. It will cause bug-on trap from locksfreelock in error handling routine...

PT-2025-16679

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns an overflow in the dacloffset bounds check within the ksmbd component of the Linux kernel. Originally, the dacloffset field was typed as int and used in an unchecked...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from ksmbd potentially releasing connections during oplock interrupt notification...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a post-release reuse issue in ksmbdfreeworkstruct...

PT-2025-16678

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been identified, specifically in the ksmbd component. The issue arises when accessing psid-sub authpsid-num subauth - 1 without checking if num...

PT-2025-16682

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved by adding a bounds check for create lease context in ksmbd. The issue was related to a missing bounds check, which has now been...

PT-2025-16680

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between session setup and ksmdb sessions deregister in the Linux kernel, specifically in the ksmbd component. This condition can lead to a session being freed...