CVE-2025-21947

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

Published Apr 1, 2025 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on
ida_alloc. req->handle from ksmbd_ipc_login_request and
FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion
between messages, resulting in access to unexpected parts of memory after
an incorrect delivery. ksmbd check type of ipc response but missing add
continue to check next ipc reponse.

Analysis

Technical impact

The Linux kernel includes a race condition in the ksmbd SMB server component that can cause type confusion between IPC messages. When req->handle values overlap, an attacker can trick the system into reading or writing unintended memory locations, potentially leading to data corruption or arbitrary code execution. The flaw arises because ksmbd fails to correctly validate the type of certain IPC responses.

Affected Systems

Vulnerable kernel versions include all Linux kernels up to and including the 6.14 development releases 6.14 rc1 through rc5. The bug is present until the upstream patch is merged into a stable release, and any kernel distribution shipping one of these affected revisions is impacted.

Risk and Exploitability

The CVSS score of 8.1 marks this as a high‑severity issue, but the EPSS score of less than 1 percent indicates a low likelihood of widespread exploitation at present. The vulnerability is not yet listed in CISA’s KEV catalog. Exploitation would likely require sending specially crafted SMB IPC requests that trigger the race condition, a technique that could be performed remotely against an exposed ksmbd service or locally on a system with privileged access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0626e6641f6b467447c81dd7678a69c66f7746cf`	affected	< 6321bbda4244b93802d61cfe0887883aae322f4b
`0626e6641f6b467447c81dd7678a69c66f7746cf`	affected	< 76861630b29e51373e73e7b00ad0d467b6941162
`0626e6641f6b467447c81dd7678a69c66f7746cf`	affected	< 3cb2b2e41541fe6f9cc55ca22d4c0bd260498aea
`0626e6641f6b467447c81dd7678a69c66f7746cf`	affected	< 1e8833c03a38e1d5d5df6484e3f670a2fd38fb76
`0626e6641f6b467447c81dd7678a69c66f7746cf`	affected	< e2ff19f0b7a30e03516e6eb73b948e27a55bc9d2

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.1.131`	unaffected	≤ 6.1.*
`6.6.83`	unaffected	≤ 6.6.*
`6.12.19`	unaffected	≤ 6.12.*
`6.13.7`	unaffected	≤ 6.13.*
`6.14`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc5::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a patched release that includes the ksmbd race‑condition fix.
Terminate or disable the ksmbd SMB server if the system does not require it.
Configure host‑based firewalls to block SMB IPC traffic to the machine.

Generated by OpenCVE AI on April 28, 2026 at 02:19 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4193-1	linux-6.1 security update
Debian DSA	DSA-5900-1	linux security update
EUVD	EUVD-2025-9374	In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion between messages, resulting in access to unexpected parts of memory after an incorrect delivery. ksmbd check type of ipc response but missing add continue to check next ipc reponse.
Ubuntu USN	USN-7605-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7605-2	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-7606-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-7628-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-7764-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7764-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-7765-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-7766-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7767-1	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-7767-2	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-7779-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-7790-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-7800-1	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-7801-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-7802-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-7801-2	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-7809-1	Linux kernel (Azure, N-Series) vulnerabilities
Ubuntu USN	USN-7801-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.392% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/1e8833c03a38e1d5d5df6484e3f670a2fd38fb76
https://git.kernel.org/stable/c/3cb2b2e41541fe6f9cc55ca22d4c0bd260498aea
https://git.kernel.org/stable/c/6321bbda4244b93802d61cfe0887883aae322f4b
https://git.kernel.org/stable/c/76861630b29e51373e73e7b00ad0d467b6941162
https://git.kernel.org/stable/c/e2ff19f0b7a30e03516e6eb73b948e27a55bc9d2
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
https://lore.kernel.org/linux-cve-announce/2025040136-CVE-2025-21947-fcc5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-21947
https://www.cve.org/CVERecord?id=CVE-2025-21947

History

Apr 2, 2026 9:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Nov 3, 2025 8:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Oct 1, 2025 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 21, 2025 2:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	threat_severity `Low`	threat_severity `Moderate`

Apr 10, 2025 6:30 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Weaknesses		CWE-362
CPEs		cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.14:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.14:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.14:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.14:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.14:rc5::::::
Vendors & Products		Linux Linux linux Kernel
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Apr 2, 2025 2:00 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025040136-CVE-2025-21947-fcc5@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-21947 https://www.cve.org/CVERecord?id=CVE-2025-21947
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Apr 1, 2025 4:00 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion between messages, resulting in access to unexpected parts of memory after an incorrect delivery. ksmbd check type of ipc response but missing add continue to check next ipc reponse.
Title		ksmbd: fix type confusion via race condition when using ipc_msg_send_request
References		https://git.kernel.org/stable/c/1e8833c03a38e1d5d5df6484e3f670a2fd38fb76 https://git.kernel.org/stable/c/3cb2b2e41541fe6f9cc55ca22d4c0bd260498aea https://git.kernel.org/stable/c/6321bbda4244b93802d61cfe0887883aae322f4b https://git.kernel.org/stable/c/76861630b29e51373e73e7b00ad0d467b6941162 https://git.kernel.org/stable/c/e2ff19f0b7a30e03516e6eb73b948e27a55bc9d2