CVE-2025-39942 ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remainingdatalength respects maxfragmentedrecvsize This is inspired by the check for dataoffset + datalength...

CVE-2023-53399

The connected documents confirm a Linux kernel vulnerability in ksmbd where a NULL pointer dereference could occur in smb2_get_info_filesystem() if share->path is NULL. A fix has been applied across affected kernels (Linux kernel 5.x line references appear in Astra Linux advisories and Debian/...

smb3: fix for slab out of bounds on mount to ksmbd

...

ksmbd: fix overflow in dacloffset bounds check

...

SUSE CVE-2025-38562

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference error in generateencryptionkey If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generateencryptionkey could happen. sess-PreauthHashValue is...

CVE-2025-38562 ksmbd: fix null pointer dereference error in generate_encryptionkey

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference error in generateencryptionkey If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generateencryptionkey could happen. sess-PreauthHashValue is...

DEBIAN-CVE-2023-3866

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in the compound request This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So...

UBUNTU-CVE-2025-38501

In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client connections. This patch limit repeated...

DEBIAN-CVE-2025-38437

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential use-after-free in oplock/lease break ack If ksmbdiovpinrsp return error, use-after-free can happen by accessing opinfo-state and opinfoput and ksmbdfdput could called twice...

UBUNTU-CVE-2025-37947

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating pos ksmbdvfsstreamwrite did not validate whether the write offset pos was within the bounds of the existing stream data length vlen. If pos was greater than or equal to vle...

CVE-2025-37947 ksmbd: prevent out-of-bounds stream writes by validating *pos

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating pos ksmbdvfsstreamwrite did not validate whether the write offset pos was within the bounds of the existing stream data length vlen. If pos was greater than or equal to vle...

kernel: smb: client: fix TCP timers deadlock after rmmod

REJECTED CVE A vulnerability was suspected in the Linux kernel's SMB client module related to TCP timers and potential deadlocks after module removal rmmod cifs. The issue stemmed from incorrect manual manipulation of sk-sknetrefcnt, which led to TCP timers not being properly cleared, causing...

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

...

UBUNTU-CVE-2025-37778

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krbauthenticate krbauthenticate frees sess-user and does not set the pointer to NULL. It calls ksmbdkrb5authenticate to reinitialise sess-user but that function may return without doing so. If that...

CVE-2025-21844 smb: client: Add check for next_buffer in receive_encrypted_standard()

In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for nextbuffer in receiveencryptedstandard Add check for the return value of cifsbufget and cifssmallbufget in receiveencryptedstandard to prevent null pointer dereference...

CVE-2025-21844

Technical details are not publicly available in the provided documents; no connected documents with concrete details for CVE-2025-21844. Monitor for updates.

CVE-2025-21725

CVE-2025-21725 Affects the Linux kernel SMB/CIFS client. The issue occurs when NETWORK_INTERFACE_INFO::LinkSpeed is not set, which can trigger an oops/divide error in cifs_debug_data_proc_show. The patch fixes this by initializing cifs_server_iface::speed to a sane default of 1 Gbps when the link...

PT-2026-8177

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's smb/server component within the create smb2 pipe function. Specifically, if the ksmbd iov pin rsp function fails, the ksmbd session rpc close function...

CVE-2024-56729

In the Linux kernel, the following vulnerability has been resolved: smb: Initialize cfid-tcon before performing network ops Avoid leaking a tcon ref when a lease break races with opening the cached directory. Processing the leak break might take a reference to the tcon in cacheddirleasebreak and...

kernel: smb: client: fix potential UAF in smb2_is_valid_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2isvalidoplockbreak Skip sessions that are being teared down status == SESEXITING to avoid UAF...