CVE-2025-21994: ksmbd: fix incorrect validation for num_aces field of smb_acl
Published Apr 2, 2025
·Updated
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix incorrect validation for numaces field of smbacl
parsedcal() validate numaces to allocate posixacestatearray.
if (numaces > ULONGMAX / sizeof(struct smbace ))
It is an incorrect validation that we can create an array of size ULONGMAX. smbacl has ->size field to calculate actual number of aces in request buffer size. Use this to check invalid numaces.
Affected Software
169 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=5.15<5.15.180
Linux Linux kernel>=5.16<6.1.132
Linux Linux kernel>=6.2<6.6.85
Linux Linux kernel>=6.7<6.12.21
Linux Linux kernel>=6.13<6.13.9
Linux Linux kernel=6.14-rc1
Linux Linux kernel=6.14-rc2
Linux Linux kernel=6.14-rc3
Linux Linux kernel=6.14-rc4
Linux Linux kernel=6.14-rc5
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.15<5.15.0-1086.93~20.04.1
5.15.0-1086.93~20.04.1
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.15<5.15.0-1091.100~20.04.1
5.15.0-1091.100~20.04.1
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.15<5.15.0-1085.94~20.04.1
5.15.0-1085.94~20.04.1
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.15<5.15.0-142.152~20.04.1
5.15.0-142.152~20.04.1
ubuntu/linux-hwe-5.8*
ubuntu/linux-ibm-5.15<5.15.0-1078.81~20.04.1
5.15.0-1078.81~20.04.1
ubuntu/linux-intel-5.13*
ubuntu/linux-intel-iotg-5.15<5.15.0-1083.89~20.04.1
5.15.0-1083.89~20.04.1
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-142.152~20.04.1
5.15.0-142.152~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1039.39~20.04.1
5.15.0-1039.39~20.04.1
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.15<5.15.0-1083.89~20.04.1
5.15.0-1083.89~20.04.1
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.15<5.15.0-1081.85~20.04.1
5.15.0-1081.85~20.04.1
ubuntu/linux-riscv-5.8*
ubuntu/linux<5.15.0-142.152
5.15.0-142.152
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1086.93
5.15.0-1086.93
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1039.41~22.04.1
6.8.0-1039.41~22.04.1
ubuntu/linux-azure<5.15.0-1091.100
5.15.0-1091.100
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1036.42~22.04.1
6.8.0-1036.42~22.04.1
ubuntu/linux-azure-fde<5.15.0-1091.100.1
5.15.0-1091.100.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1085.94
5.15.0-1085.94
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1040.42~22.04.1
6.8.0-1040.42~22.04.1
ubuntu/linux-gke<5.15.0-1083.89
5.15.0-1083.89
ubuntu/linux-gkeop<5.15.0-1068.76
5.15.0-1068.76
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-85.85~22.04.1
6.8.0-85.85~22.04.1
ubuntu/linux-ibm<5.15.0-1078.81
5.15.0-1078.81
ubuntu/linux-ibm-6.8<6.8.0-1037.37~22.04.1
6.8.0-1037.37~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1081.87
5.15.0-1081.87
ubuntu/linux-kvm<5.15.0-1082.87
5.15.0-1082.87
ubuntu/linux-lowlatency<5.15.0-142.152
5.15.0-142.152
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-84.84.1~22.04.1
6.8.0-84.84.1~22.04.1
ubuntu/linux-nvidia<5.15.0-1080.81
5.15.0-1080.81
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1039.42~22.04.1
6.8.0-1039.42~22.04.1
ubuntu/linux-nvidia-tegra<5.15.0-1039.39
5.15.0-1039.39
ubuntu/linux-nvidia-tegra-igx<5.15.0-1028.28
5.15.0-1028.28
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1083.89
5.15.0-1083.89
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1037.38~22.04.1
6.8.0-1037.38~22.04.1
ubuntu/linux-raspi<5.15.0-1080.83
5.15.0-1080.83
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-84.84~22.04.1
6.8.0-84.84~22.04.1
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1050.54
5.15.0-1050.54
ubuntu/linux-bluefield<5.15.0-1069.71
5.15.0-1069.71
ubuntu/linux-intel-iot-realtime<5.15.0-1079.81
5.15.0-1079.81
ubuntu/linux-realtime<5.15.0-1086.95
5.15.0-1086.95
ubuntu/linux-realtime-6.8<6.8.1-1034.35~22.04.1
6.8.1-1034.35~22.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1086.93+fips1
5.15.0-1086.93+fips1
ubuntu/linux-azure-fips<5.15.0-1091.100+fips1
5.15.0-1091.100+fips1
ubuntu/linux-fips<5.15.0-142.152+fips1
5.15.0-142.152+fips1
ubuntu/linux-gcp-fips<5.15.0-1085.94+fips1
5.15.0-1085.94+fips1
ubuntu/linux<6.8.0-84.84
6.8.0-84.84
ubuntu/linux-aws<6.8.0-1039.41
6.8.0-1039.41
ubuntu/linux-azure<6.8.0-1038.44
6.8.0-1038.44
ubuntu/linux-azure-6.11<6.11.0-1018.18~24.04.1
6.11.0-1018.18~24.04.1
ubuntu/linux-azure-nvidia<6.8.0-1025.27
6.8.0-1025.27
ubuntu/linux-gcp<6.8.0-1040.42
6.8.0-1040.42
ubuntu/linux-gcp-6.11<6.11.0-1016.16~24.04.1
6.11.0-1016.16~24.04.1
ubuntu/linux-gke<6.8.0-1036.40
6.8.0-1036.40
ubuntu/linux-gkeop<6.8.0-1023.25
6.8.0-1023.25
ubuntu/linux-hwe-6.11<6.11.0-28.28~24.04.1
6.11.0-28.28~24.04.1
ubuntu/linux-ibm<6.8.0-1037.37
6.8.0-1037.37
ubuntu/linux-intel*
ubuntu/linux-lowlatency<6.8.0-84.84.1
6.8.0-84.84.1
ubuntu/linux-lowlatency-hwe-6.11<6.11.0-1015.16~24.04.2
6.11.0-1015.16~24.04.2
ubuntu/linux-nvidia<6.8.0-1039.42
6.8.0-1039.42
ubuntu/linux-nvidia-6.11<6.11.0-1012.12
6.11.0-1012.12
ubuntu/linux-nvidia-lowlatency<6.8.0-1039.42.1
6.8.0-1039.42.1
ubuntu/linux-nvidia-tegra<6.8.0-1010.10
6.8.0-1010.10
ubuntu/linux-oem-6.11<6.11.0-1024.24
6.11.0-1024.24
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1037.38
6.8.0-1037.38
ubuntu/linux-raspi<6.8.0-1039.43
6.8.0-1039.43
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-xilinx<6.8.0-1018.19
6.8.0-1018.19
ubuntu/linux-raspi-realtime<6.8.0-2030.31
6.8.0-2030.31
ubuntu/linux-realtime<6.8.1-1034.35
6.8.1-1034.35
ubuntu/linux-aws-fips<6.8.0-1039.41+fips1
6.8.0-1039.41+fips1
ubuntu/linux-azure-fips<6.8.0-1040.46+fips1
6.8.0-1040.46+fips1
ubuntu/linux-fips<6.8.0-84.84+fips1
6.8.0-84.84+fips1
ubuntu/linux-gcp-fips<6.8.0-1040.42+fips1
6.8.0-1040.42+fips1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix incorrect validation for the smb_acl field by checking: if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) then treat num_aces as invalid and reject/handle the request before allocating posix_ace_state_array.
ksmbd (parse_dcal / smb_acl allocation) num_aces validation = Validate that num_aces does not exceed ULONG_MAX / sizeof(struct smb_ace *) before allocating posix_ace_state_array
Event History
Apr 2, 2025
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionSeverity
Data Sourced
via OSV·02:16 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·02:16 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-21994?
CVE-2025-21994 is classified as a high-severity vulnerability affecting the Linux kernel.
2
How do I fix CVE-2025-21994?
To address CVE-2025-21994, update your Linux kernel to the latest available version that contains the fix.
3
What are the consequences of exploiting CVE-2025-21994?
Exploiting CVE-2025-21994 could lead to unauthorized access or modification of ACLs within the kernel.
4
Which versions of the Linux kernel are affected by CVE-2025-21994?
CVE-2025-21994 affects various versions of the Linux kernel up to the fixed release.
5
Is CVE-2025-21994 related to SMB functionality in the Linux kernel?
Yes, CVE-2025-21994 involves a fix related to incorrect validation within the SMB ACL handling of the Linux kernel.