CVE-2025-39975

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39975", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.150Z", "datePublished": "2025-10-15T07:55:56.951Z", "dateUpdated": "2026-08-05T12:06:43.934Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:43.934Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix wrong index reference in smb2_compound_op()\n\nIn smb2_compound_op(), the loop that processes each command's response\nuses wrong indices when accessing response bufferes.\n\nThis incorrect indexing leads to improper handling of command results.\nAlso, if incorrectly computed index is greather than or equal to\nMAX_COMPOUND, it can cause out-of-bounds accesses."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code parses SMB2 compound responses received over TCP/445 from the remote server, so a malicious, compromised, or on-path (unsigned/downgraded session) SMB server triggers it purely with network traffic. This matches the established scoring for fs/smb/client response-parsing flaws such as CVE-2026-46155 in this same function.\nAC:L - The server fully controls the per-command NT status codes and payload of each element in the compound chain, so it deterministically arranges \"CLOSE succeeds / QUERY_WSL_EA fails\" and shapes the error-response body that then gets parsed as an EA buffer. No race, memory-layout guess, or condition outside the attacker's control is involved.\nPR:N - The attacker is the server side of the connection (or an on-path injector) and needs no account or privilege on the victim client. Once the client has a session to the server, every subsequent path lookup drives the vulnerable parser.\nUI:N - On an already-mounted share (fstab, autofs/systemd automount, container image, or a server that was compromised after mount), ordinary background filesystem activity such as stat()/lookup reaches smb2_query_path_info() -> smb2_compound_op() with no victim action. This matches UI:N used for the equivalent smb2_compound_op() EA parsing CVE.\nS:U - The corruption and its consequences are confined to the kernel's own security authority on the client; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Treating an error response as a successful QUERY_INFO/QUERY_WSL_EA lets an attacker-chosen OutputBufferOffset/OutputBufferLength drive memcpy() past the end of the response allocation, copying adjacent kernel heap memory into idata->wsl.eas, which wsl_to_fattr() then exposes to userspace as file uid/gid/mode/rdev. This is an out-of-bounds kernel heap read with a user-visible channel.\nI:H - Command results are attributed to the wrong response buffer, so failed server operations are accepted as successful and inode state \u2014 attributes, reparse tag, and WSL-derived uid/gid/mode/rdev used for access decisions \u2014 is populated from an incorrect, attacker-shaped, partly out-of-bounds buffer. The wrong-index accesses into the rsp_iov array are a memory-safety error class that is not inherently read-limited.\nA:H - The out-of-bounds read past the response buffer can touch unmapped memory and oops the kernel, and parsing an error response as reparse/EA data produces garbage-driven kernel faults. Any such crash is a full availability loss for the client system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2inode.c"], "versions": [{"version": "5ddcc9e92d54548219985ce4de88618fb53e14ec", "lessThan": "ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5", "status": "affected", "versionType": "git"}, {"version": "efe8db3ecaa40a8520dc9a54283dcecd82ceea9c", "lessThan": "bfb1e2aad1fecef8320fd71332acde0d53a8d699", "status": "affected", "versionType": "git"}, {"version": "3681c74d342db75b0d641ba60de27bf73e16e66b", "lessThan": "093615fc76063ea08d454ba86677ce64c736e806", "status": "affected", "versionType": "git"}, {"version": "3681c74d342db75b0d641ba60de27bf73e16e66b", "lessThan": "fbe2dc6a9c7318f7263f5e4d50f6272b931c5756", "status": "affected", "versionType": "git"}, {"version": "77aefd1d9b790f60634adebbdcfffbe934f41c34", "status": "affected", "versionType": "git"}, {"version": "6.6.75", "lessThan": "6.6.109", "status": "affected", "versionType": "semver"}, {"version": "6.12.12", "lessThan": "6.12.50", "status": "affected", "versionType": "semver"}, {"version": "6.13.1", "lessThan": "6.14", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2inode.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.109", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.50", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.10", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.75", "versionEndExcluding": "6.6.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.12", "versionEndExcluding": "6.12.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.16.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5"}, {"url": "https://git.kernel.org/stable/c/bfb1e2aad1fecef8320fd71332acde0d53a8d699"}, {"url": "https://git.kernel.org/stable/c/093615fc76063ea08d454ba86677ce64c736e806"}, {"url": "https://git.kernel.org/stable/c/fbe2dc6a9c7318f7263f5e4d50f6272b931c5756"}], "title": "smb: client: fix wrong index reference in smb2_compound_op()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5", "status": "affected", "version": "5ddcc9e92d54548219985ce4de88618fb53e14ec", "versionType": "git"}, {"lessThan": "bfb1e2aad1fecef8320fd71332acde0d53a8d699", "status": "affected", "version": "efe8db3ecaa40a8520dc9a54283dcecd82ceea9c", "versionType": "git"}, {"lessThan": "093615fc76063ea08d454ba86677ce64c736e806", "status": "affected", "version": "3681c74d342db75b0d641ba60de27bf73e16e66b", "versionType": "git"}, {"lessThan": "fbe2dc6a9c7318f7263f5e4d50f6272b931c5756", "status": "affected", "version": "3681c74d342db75b0d641ba60de27bf73e16e66b", "versionType": "git"}, {"status": "affected", "version": "77aefd1d9b790f60634adebbdcfffbe934f41c34", "versionType": "git"}, {"lessThan": "6.6.109", "status": "affected", "version": "6.6.75", "versionType": "semver"}, {"lessThan": "6.12.50", "status": "affected", "version": "6.12.12", "versionType": "semver"}, {"lessThan": "6.14", "status": "affected", "version": "6.13.1", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.109", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.50", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix wrong index reference in smb2_compound_op()\n\nIn smb2_compound_op(), the loop that processes each command's response\nuses wrong indices when accessing response bufferes.\n\nThis incorrect indexing leads to improper handling of command results.\nAlso, if incorrectly computed index is greather than or equal to\nMAX_COMPOUND, it can cause out-of-bounds accesses."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: corrige referencia de \u00edndice incorrecta en smb2_compound_op()\n\nEn smb2_compound_op(), el bucle que procesa la respuesta de cada comando usa \u00edndices incorrectos al acceder a los b\u00faferes de respuesta.\n\nEsta indexaci\u00f3n incorrecta lleva a un manejo inadecuado de los resultados del comando. Adem\u00e1s, si el \u00edndice calculado incorrectamente es mayor o igual que MAX_COMPOUND, puede causar accesos fuera de l\u00edmites."}], "id": "CVE-2025-39975", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-10-15T08:15:35.273", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/093615fc76063ea08d454ba86677ce64c736e806"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bfb1e2aad1fecef8320fd71332acde0d53a8d699"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fbe2dc6a9c7318f7263f5e4d50f6272b931c5756"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: smb: client: fix wrong index reference in smb2_compound_op()", "id": "2404106", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404106"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: fix wrong index reference in smb2_compound_op()\nIn smb2_compound_op(), the loop that processes each command's response\nuses wrong indices when accessing response bufferes.\nThis incorrect indexing leads to improper handling of command results.\nAlso, if incorrectly computed index is greather than or equal to\nMAX_COMPOUND, it can cause out-of-bounds accesses."], "name": "CVE-2025-39975", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39975\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39975\nhttps://lore.kernel.org/linux-cve-announce/2025101557-CVE-2025-39975-d1a3@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-20T13:27:14.133378+00:00", "updated": "2025-10-20T13:27:14.133401+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}