CVE-2025-39943

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39943", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.148Z", "datePublished": "2025-10-04T07:31:05.581Z", "dateUpdated": "2026-08-05T12:06:18.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:18.093Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer\n\nIf data_offset and data_length of smb_direct_data_transfer struct are\ninvalid, out of bounds issue could happen.\nThis patch validate data_offset and data_length field in recv_done."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "baseScore": 9.4, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - ksmbd is the in-kernel SMB server and this code parses the SMB Direct data-transfer header received from a remote peer over RDMA (iWARP/RoCEv2 are routable over ordinary IP networks, and soft-iWARP/soft-RoCE expose it without special hardware). The attacker only needs to reach the SMB Direct listener.\nAC:L - The attacker simply completes the SMBD negotiate handshake and sends one data-transfer message with an arbitrary data_offset field; no race, no memory-layout precondition, and the trigger is fully deterministic and repeatable.\nPR:N - The vulnerable memcpy executes on the very first SMB2 PDU read by ksmbd_conn_handler_loop, i.e. before SMB2 NEGOTIATE and SESSION_SETUP, so no SMB credentials or authentication are required. Only the transport-level SMBD negotiate, which is unauthenticated, precedes it.\nUI:N - The server processes the malicious SMB Direct packet automatically in its receive completion and connection handler paths. No local user or administrator action is involved.\nS:U - The out-of-bounds access and its consequences are confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unvalidated 32-bit data_offset lets a remote unauthenticated peer read up to ~8 KB from any offset within 4 GiB of an 8 KB slab object, and the leaked bytes are installed as the SMB2 request whose header fields are echoed back in responses, yielding a repeatable byte-granular kernel memory disclosure oracle.\nI:L - There is no out-of-bounds write, but the server assembles and dispatches an SMB2 request built from out-of-bounds kernel memory, so connection and request-handling state is driven by data the attacker caused it to read from outside the intended buffer.\nA:H - A large data_offset makes the memcpy read unmapped memory, vmalloc guard pages, or memory past the end of the direct map, faulting in kernel context and producing an oops (a full panic with panic_on_oops) and tearing down the ksmbd connection handler thread."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/transport_rdma.c"], "versions": [{"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "lessThan": "773fddf976d282ef059c36c575ddb81567acd6bc", "status": "affected", "versionType": "git"}, {"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "lessThan": "bdaab5c6538e250a9654127e688ecbbeb6f771d5", "status": "affected", "versionType": "git"}, {"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "lessThan": "eb0378dde086363046ed3d7db7f126fc3f76fd70", "status": "affected", "versionType": "git"}, {"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "lessThan": "8be498fcbd5b07272f560b45981d4b9e5a2ad885", "status": "affected", "versionType": "git"}, {"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "lessThan": "529b121b00a6ee3c88fb3c01b443b2b81f686d48", "status": "affected", "versionType": "git"}, {"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "lessThan": "5282491fc49d5614ac6ddcd012e5743eecb6a67c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/transport_rdma.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.194", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.154", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.108", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.49", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.9", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.194"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.154"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.108"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.49"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.16.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/773fddf976d282ef059c36c575ddb81567acd6bc"}, {"url": "https://git.kernel.org/stable/c/bdaab5c6538e250a9654127e688ecbbeb6f771d5"}, {"url": "https://git.kernel.org/stable/c/eb0378dde086363046ed3d7db7f126fc3f76fd70"}, {"url": "https://git.kernel.org/stable/c/8be498fcbd5b07272f560b45981d4b9e5a2ad885"}, {"url": "https://git.kernel.org/stable/c/529b121b00a6ee3c88fb3c01b443b2b81f686d48"}, {"url": "https://git.kernel.org/stable/c/5282491fc49d5614ac6ddcd012e5743eecb6a67c"}], "title": "ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/transport_rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "773fddf976d282ef059c36c575ddb81567acd6bc", "status": "affected", "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "versionType": "git"}, {"lessThan": "bdaab5c6538e250a9654127e688ecbbeb6f771d5", "status": "affected", "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "versionType": "git"}, {"lessThan": "eb0378dde086363046ed3d7db7f126fc3f76fd70", "status": "affected", "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "versionType": "git"}, {"lessThan": "8be498fcbd5b07272f560b45981d4b9e5a2ad885", "status": "affected", "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "versionType": "git"}, {"lessThan": "529b121b00a6ee3c88fb3c01b443b2b81f686d48", "status": "affected", "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "versionType": "git"}, {"lessThan": "5282491fc49d5614ac6ddcd012e5743eecb6a67c", "status": "affected", "version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/transport_rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.194", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.154", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.108", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.49", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "399525B9-AAAB-4098-818B-2A4F765D94B0", "versionEndExcluding": "5.15.194", "versionStartIncluding": "5.15.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E49CD91E-FC55-45B0-BB63-9AD5F5D70CAA", "versionEndExcluding": "6.1.154", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7E8EAEE-7731-4996-9578-696255D61EA2", "versionEndExcluding": "6.6.108", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CAA033E9-A2C5-4976-A83E-9804D8FB827F", "versionEndExcluding": "6.12.49", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "638DD910-1189-4F5E-98BF-2D436B695112", "versionEndExcluding": "6.16.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*", "matchCriteriaId": "40D9C0D1-0F32-4A2B-9840-1072F5497540", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*", "matchCriteriaId": "948A6B8D-1B72-4945-8680-354E53BE1C80", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*", "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*", "matchCriteriaId": "5A4516A6-C12E-42A4-8C0E-68AEF3264504", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer\n\nIf data_offset and data_length of smb_direct_data_transfer struct are\ninvalid, out of bounds issue could happen.\nThis patch validate data_offset and data_length field in recv_done."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: smbdirect: validar el campo data_offset y data_length de smb_direct_data_transfer\n\nSi data_offset y data_length de la estructura smb_direct_data_transfer son inv\u00e1lidos, podr\u00eda ocurrir un problema de fuera de l\u00edmites.\nEste parche valida el campo data_offset y data_length en recv_done."}], "id": "CVE-2025-39943", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-10-04T08:15:47.357", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5282491fc49d5614ac6ddcd012e5743eecb6a67c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/529b121b00a6ee3c88fb3c01b443b2b81f686d48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/773fddf976d282ef059c36c575ddb81567acd6bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8be498fcbd5b07272f560b45981d4b9e5a2ad885"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bdaab5c6538e250a9654127e688ecbbeb6f771d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eb0378dde086363046ed3d7db7f126fc3f76fd70"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer", "id": "2401424", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401424"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer\nIf data_offset and data_length of smb_direct_data_transfer struct are\ninvalid, out of bounds issue could happen.\nThis patch validate data_offset and data_length field in recv_done."], "name": "CVE-2025-39943", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39943\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39943\nhttps://lore.kernel.org/linux-cve-announce/2025100419-CVE-2025-39943-f5d8@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-06T14:41:57.789917+00:00", "updated": "2025-10-06T14:41:57.789998+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}