CVE-2025-21946

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21946
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parse_sec_desc() If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when validating sid, It need to check it included subauth array size.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/159d059cbcb0e6d0e7a7b34af3862ba09a6b22d1 Patch
https://git.kernel.org/stable/c/6a9831180d0b23b5c97e2bd841aefc8f82900172 Patch
https://git.kernel.org/stable/c/c1569dbbe2d43041be9f3fef7ca08bec3b66ad1b Patch
https://git.kernel.org/stable/c/d6e13e19063db24f94b690159d0633aaf72a0f03 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
History

30 Oct 2025, 19:43

Type Values Removed Values Added
CWE CWE-125
References () https://git.kernel.org/stable/c/159d059cbcb0e6d0e7a7b34af3862ba09a6b22d1 - () https://git.kernel.org/stable/c/159d059cbcb0e6d0e7a7b34af3862ba09a6b22d1 - Patch
References () https://git.kernel.org/stable/c/6a9831180d0b23b5c97e2bd841aefc8f82900172 - () https://git.kernel.org/stable/c/6a9831180d0b23b5c97e2bd841aefc8f82900172 - Patch
References () https://git.kernel.org/stable/c/c1569dbbe2d43041be9f3fef7ca08bec3b66ad1b - () https://git.kernel.org/stable/c/c1569dbbe2d43041be9f3fef7ca08bec3b66ad1b - Patch
References () https://git.kernel.org/stable/c/d6e13e19063db24f94b690159d0633aaf72a0f03 - () https://git.kernel.org/stable/c/d6e13e19063db24f94b690159d0633aaf72a0f03 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: se corrige un error fuera de los límites en parse_sec_desc(). Si osidoffset, gsidoffset y dacloffset pueden ser mayores que el tamaño de la estructura smb_ntsd, si es menor, podría causar un error fuera de los límites de slab. Al validar sid, es necesario comprobar si incluye el tamaño del array subauth.
First Time Linux
Linux linux Kernel

01 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 16:15

Updated : 2025-10-30 19:43

NVD link : CVE-2025-21946

Mitre link : CVE-2025-21946

CVE.ORG link : CVE-2025-21946

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read