CVE-2025-21947 ksmbd: fix type confusion via race condition when using ipc_msg_send_request
A race condition in the Linux kernel ksmbd module allows type confusion, potentially leading to memory corruption and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21947?
CVE-2025-21947 is a high-severity vulnerability in Linux kernel, published on 1 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix type confusion via race condition when using ipc_msg_send_request
req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion between messages, resulting in access to unexpected parts of memory after an incorrect delivery. ksmbd check type of ipc response but missing add continue to check next ipc reponse.
Weakness: CWE-362
Which versions are affected by CVE-2025-21947?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21947?
Apply the vendor's patch.
Is CVE-2025-21947 being exploited?
There is no known exploitation of CVE-2025-21947 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-59760, AZL-59862, BELL-CVE-2025-21947, DEBIAN-CVE-2025-21947, GHSA-7c5j-6262-p78w, ROOT-OS-UBUNTU-2204-CVE-2025-21947 and 2 more.