CVE-2025-22039: ksmbd: fix overflow in dacloffset bounds check
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix overflow in dacloffset bounds check
The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smbcheckpermdacl() and smbinheritdacl().
This could result in out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer.
This patch converts dacloffset to unsigned int and uses checkaddoverflow() to validate access to the DACL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch ksmbd: fix overflow in dacloffset bounds check
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22039?
The severity of CVE-2025-22039 is considered moderate due to potential overflow issues.
How do I fix CVE-2025-22039?
To fix CVE-2025-22039, users should update their Linux kernel to the latest patched version.
Which Linux versions are affected by CVE-2025-22039?
CVE-2025-22039 affects several versions of the Linux kernel that utilize the ksmbd module.
What are the implications of CVE-2025-22039?
CVE-2025-22039 could allow an attacker to exploit an overflow to bypass permission checks.
Is CVE-2025-22039 publicly known?
Yes, CVE-2025-22039 has been publicly disclosed and documented.