CVE-2025-40099 cifs: parse_dfs_referrals: prevent oob on malformed input
A malicious SMB server can trigger an out-of-bounds memory access in the Linux kernel CIFS module via malformed DFS referral replies, potentially causing crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40099?
CVE-2025-40099 is a critical memory corruption vulnerability in Linux, published on 30 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cifs: parse_dfs_referrals: prevent oob on malformed input
Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS
- reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of referrals smaller than NumberOfReferrals in the header
Processing of such replies will cause oob.
Return -EINVAL error on such replies to prevent oob-s.
Which versions are affected by CVE-2025-40099?
How do I fix CVE-2025-40099?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-40099 being exploited?
There is no known exploitation of CVE-2025-40099 in the wild and no public exploit code.
Sources
Also known as AZL-69436, BELL-CVE-2025-40099, DEBIAN-CVE-2025-40099, GHSA-58x9-22gw-84q7, ROOT-OS-DEBIAN-11-CVE-2025-40099, ROOT-OS-DEBIAN-13-CVE-2025-40099 and 3 more.