What’s Vulnerable › Vulnerabilities

CVE-2025-22038: ksmbd: validate zero num_subauth before sub_auth is accessed

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-16 · updated 2026-07-30
• Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate zero num_subauth before sub_auth is accessed Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-bounds read. This patch adds a validation step to ensure num_subauth != 0 before sub_auth is accessed.

Affected products

• Linux kernel: before 6.1.134; from 6.2 before 6.6.87; from 6.7 before 6.12.23; from 6.13 before 6.13.11; from 6.14 before 6.14.2 — fixed in 6.1.134, 6.12.23, 6.13.11, 6.14.2, 6.6.87

How to fix

Upgrade to a fixed version: Linux kernel 6.1.134, 6.12.23, 6.13.11, 6.14.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0e36a3e080d6d8bd7a34e089345d043da4ac8283
• https://git.kernel.org/stable/c/3ac65de111c686c95316ade660f8ba7aea3cd3cc
• https://git.kernel.org/stable/c/56de7778a48560278c334077ace7b9ac4bfb2fd1
• https://git.kernel.org/stable/c/68c6c3142bfcdb049839d40a9a59ebe8ea865002
• https://git.kernel.org/stable/c/bf21e29d78cd2c2371023953d9c82dfef82ebb36
• https://git.kernel.org/stable/c/c8bfe1954a0b89e7b29b3a3e7f4c5e0ebd295e20
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Get alerted when CVE-2025-22038 or the next vulnerability affects your stack