CVE-2025-22039

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22039
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smb_check_perm_dacl() and smb_inherit_dacl(). This could result in out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer. This patch converts dacloffset to unsigned int and uses check_add_overflow() to validate access to the DACL.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/443b373a4df5a2cb9f7b8c4658b2afedeb16397f Patch
https://git.kernel.org/stable/c/6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dc Patch
https://git.kernel.org/stable/c/6b8d379048b168a0dff5ab1acb975b933f368514 Patch
https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

14 Nov 2025, 16:51

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-190
CWE-125
References () https://git.kernel.org/stable/c/443b373a4df5a2cb9f7b8c4658b2afedeb16397f - () https://git.kernel.org/stable/c/443b373a4df5a2cb9f7b8c4658b2afedeb16397f - Patch
References () https://git.kernel.org/stable/c/6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dc - () https://git.kernel.org/stable/c/6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dc - Patch
References () https://git.kernel.org/stable/c/6b8d379048b168a0dff5ab1acb975b933f368514 - () https://git.kernel.org/stable/c/6b8d379048b168a0dff5ab1acb975b933f368514 - Patch
References () https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42 - () https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: corrección de desbordamiento en la comprobación de los límites de dacloffset. El campo dacloffset se tipificó originalmente como int y se usó en una adición sin comprobar, lo que podría desbordarse y omitir la comprobación de los límites existente tanto en smb_check_perm_dacl() como en smb_inherit_dacl(). Esto podría provocar un acceso a memoria fuera de los límites y un fallo del kernel al desreferenciar el puntero DACL. Este parche convierte dacloffset a unsigned int y utiliza check_add_overflow() para validar el acceso a la DACL.
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1

16 Apr 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 15:15

Updated : 2025-11-14 16:51

NVD link : CVE-2025-22039

Mitre link : CVE-2025-22039

CVE.ORG link : CVE-2025-22039

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read

CWE-190

Integer Overflow or Wraparound