CVE-2025-22039 ksmbd: fix overflow in dacloffset bounds check
An integer overflow in the Linux kernel's ksmbd module allows bypassing bounds checks, leading to out-of-bounds memory access and kernel crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-22039?
CVE-2025-22039 is a high-severity vulnerability in Linux kernel, published on 16 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix overflow in dacloffset bounds check
The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smb_check_perm_dacl() and smb_inherit_dacl().
This could result in out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer.
This patch converts dacloffset to unsigned int and uses check_add_overflow() to validate access to the DACL.
Which versions are affected by CVE-2025-22039?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-22039?
Apply the vendor's patch.
Is CVE-2025-22039 being exploited?
There is no known exploitation of CVE-2025-22039 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-22039, DEBIAN-CVE-2025-22039, GHSA-xm3p-r4jv-jxcf, ROOT-OS-DEBIAN-12-CVE-2025-22039, ROOT-OS-UBUNTU-2204-CVE-2025-22039, ROOT-OS-UBUNTU-2404-CVE-2025-22039 and 1 more.