CVE-2025-21844 (GCVE-0-2025-21844)

Vulnerability from cvelistv5 – Published: 2025-03-12 09:42 – Updated: 2026-08-05 11:54
VLAI
Title
smb: client: Add check for next_buffer in receive_encrypted_standard()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent null pointer dereference.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b03c8099a738a04d2343547ae6a04e5f0f63d3fa , < f277e479eea3d1aa18bc712abe1d2bf3dece2e30 (git)
Affected: 858e73ff25639a0cc1f6f8d2587b62c045867e41 , < f618aeb6cad2307e48a641379db610abcf593edf (git)
Affected: 9f528a8e68327117837b5e28b096f52af4c26a05 , < 24e8e4523d3071bc5143b0db9127d511489f7b3b (git)
Affected: 534733397da26de0303057ce0b93a22bda150365 , < 9e5d99a4cf2e23c716b44862975548415fae5391 (git)
Affected: eec04ea119691e65227a97ce53c0da6b9b74b0b7 , < a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd (git)
Affected: eec04ea119691e65227a97ce53c0da6b9b74b0b7 , < 554736b583f529ee159aa95af9a0cbc12b5ffc96 (git)
Affected: eec04ea119691e65227a97ce53c0da6b9b74b0b7 , < 860ca5e50f73c2a1cef7eefc9d39d04e275417f7 (git)
Affected: 5.10.211 , < 5.10.235 (semver)
Affected: 5.15.150 , < 5.15.179 (semver)
Affected: 6.1.69 , < 6.1.130 (semver)
Affected: 6.6.8 , < 6.6.80 (semver)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 5.10.235 , ≤ 5.10.* (semver)
Unaffected: 5.15.179 , ≤ 5.15.* (semver)
Unaffected: 6.1.130 , ≤ 6.1.* (semver)
Unaffected: 6.6.80 , ≤ 6.6.* (semver)
Unaffected: 6.12.17 , ≤ 6.12.* (semver)
Unaffected: 6.13.5 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:26:41.993251Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:34.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:38:00.594Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:04:02.128Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f277e479eea3d1aa18bc712abe1d2bf3dece2e30",
              "status": "affected",
              "version": "b03c8099a738a04d2343547ae6a04e5f0f63d3fa",
              "versionType": "git"
            },
            {
              "lessThan": "f618aeb6cad2307e48a641379db610abcf593edf",
              "status": "affected",
              "version": "858e73ff25639a0cc1f6f8d2587b62c045867e41",
              "versionType": "git"
            },
            {
              "lessThan": "24e8e4523d3071bc5143b0db9127d511489f7b3b",
              "status": "affected",
              "version": "9f528a8e68327117837b5e28b096f52af4c26a05",
              "versionType": "git"
            },
            {
              "lessThan": "9e5d99a4cf2e23c716b44862975548415fae5391",
              "status": "affected",
              "version": "534733397da26de0303057ce0b93a22bda150365",
              "versionType": "git"
            },
            {
              "lessThan": "a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd",
              "status": "affected",
              "version": "eec04ea119691e65227a97ce53c0da6b9b74b0b7",
              "versionType": "git"
            },
            {
              "lessThan": "554736b583f529ee159aa95af9a0cbc12b5ffc96",
              "status": "affected",
              "version": "eec04ea119691e65227a97ce53c0da6b9b74b0b7",
              "versionType": "git"
            },
            {
              "lessThan": "860ca5e50f73c2a1cef7eefc9d39d04e275417f7",
              "status": "affected",
              "version": "eec04ea119691e65227a97ce53c0da6b9b74b0b7",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.235",
              "status": "affected",
              "version": "5.10.211",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.179",
              "status": "affected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.130",
              "status": "affected",
              "version": "6.1.69",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.80",
              "status": "affected",
              "version": "6.6.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.10.211",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.15.150",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.130",
                  "versionStartIncluding": "6.1.69",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.80",
                  "versionStartIncluding": "6.6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.17",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Add check for next_buffer in receive_encrypted_standard()\n\nAdd check for the return value of cifs_buf_get() and cifs_small_buf_get()\nin receive_encrypted_standard() to prevent null pointer dereference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the SMB client\u0027s receive path (cifs_demultiplex_thread \u2192 smb3_receive_transform \u2192 receive_encrypted_standard), which parses an encrypted compounded SMB2/SMB3 response arriving from the remote server over TCP/445 or RDMA. The triggering input (a response with a non-zero NextCommand) comes entirely from the remote peer, so the vulnerable code is reached across the network.\nAC:L - A malicious or compromised SMB server reliably reaches the allocation by simply returning a compounded encrypted response with NextCommand set, and can drive the client toward buffer-pool exhaustion with large/compounded responses and many outstanding requests, retrying indefinitely until an allocation fails. No memory-layout or timing condition outside the attacker\u0027s influence is needed.\nPR:N - The attacker is the SMB server (or a compromised legitimate server) and needs no account, credentials, or any privilege level on the victim client system. Nothing on the client-side path performs a privilege check before the demultiplex thread parses the response.\nUI:N - Once a share is mounted \u2014 including long-lived mounts, automounts, or a server that is compromised after the mount \u2014 the server can send the malicious compounded response at any time with no action by any user on the client. Response processing happens asynchronously in the cifsd kernel thread, independent of user activity.\nS:U - The NULL dereference occurs in kernel context on the client and its impact is confined to that kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - cifs_buf_get()/cifs_small_buf_get() returning NULL leads to memcpy() into a NULL destination, which faults immediately on the unmapped zero page; no kernel memory is read out or exposed to the attacker.\nI:N - The faulting write targets address 0 and is aborted by the page fault handler, so no kernel data structure is modified and no control-flow hijack primitive is produced.\nA:H - The unchecked NULL dereference causes a kernel oops in the cifsd demultiplex thread, tearing down the connection handling and typically panicking the system (or on panic_on_oops/hardened configurations, halting it), which is a full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:52.911Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f277e479eea3d1aa18bc712abe1d2bf3dece2e30"
        },
        {
          "url": "https://git.kernel.org/stable/c/f618aeb6cad2307e48a641379db610abcf593edf"
        },
        {
          "url": "https://git.kernel.org/stable/c/24e8e4523d3071bc5143b0db9127d511489f7b3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e5d99a4cf2e23c716b44862975548415fae5391"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/554736b583f529ee159aa95af9a0cbc12b5ffc96"
        },
        {
          "url": "https://git.kernel.org/stable/c/860ca5e50f73c2a1cef7eefc9d39d04e275417f7"
        }
      ],
      "title": "smb: client: Add check for next_buffer in receive_encrypted_standard()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21844",
    "datePublished": "2025-03-12T09:42:00.435Z",
    "dateReserved": "2024-12-29T08:45:45.778Z",
    "dateUpdated": "2026-08-05T11:54:52.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21844",
      "date": "2026-08-05",
      "epss": "0.00572",
      "percentile": "0.44051"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:31:38.000Z",
      "cve": "CVE-2025-21844",
      "id": "msrc_CVE-2025-21844",
      "initial_release_date": "2025-03-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: Add check for next_buffer in receive_encrypted_standard()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21844.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21844\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-12T10:15:16.677\",\"lastModified\":\"2026-07-30T06:21:40.750\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: Add check for next_buffer in receive_encrypted_standard()\\n\\nAdd check for the return value of cifs_buf_get() and cifs_small_buf_get()\\nin receive_encrypted_standard() to prevent null pointer dereference.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: Agregar verificaci\u00f3n para next_buffer en receive_encrypted_standard() Agregar verificaci\u00f3n para el valor de retorno de cifs_buf_get() y cifs_small_buf_get() en receive_encrypted_standard() para evitar la desreferencia del puntero nulo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb2ops.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b03c8099a738a04d2343547ae6a04e5f0f63d3fa\",\"lessThan\":\"f277e479eea3d1aa18bc712abe1d2bf3dece2e30\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"858e73ff25639a0cc1f6f8d2587b62c045867e41\",\"lessThan\":\"f618aeb6cad2307e48a641379db610abcf593edf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f528a8e68327117837b5e28b096f52af4c26a05\",\"lessThan\":\"24e8e4523d3071bc5143b0db9127d511489f7b3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"534733397da26de0303057ce0b93a22bda150365\",\"lessThan\":\"9e5d99a4cf2e23c716b44862975548415fae5391\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eec04ea119691e65227a97ce53c0da6b9b74b0b7\",\"lessThan\":\"a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eec04ea119691e65227a97ce53c0da6b9b74b0b7\",\"lessThan\":\"554736b583f529ee159aa95af9a0cbc12b5ffc96\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eec04ea119691e65227a97ce53c0da6b9b74b0b7\",\"lessThan\":\"860ca5e50f73c2a1cef7eefc9d39d04e275417f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.211\",\"lessThan\":\"5.10.235\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.150\",\"lessThan\":\"5.15.179\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.69\",\"lessThan\":\"6.1.130\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.8\",\"lessThan\":\"6.6.80\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/smb2ops.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.235\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.179\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.130\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.80\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.17\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.5\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:26:41.993251Z\",\"id\":\"CVE-2025-21844\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.69\",\"versionEndExcluding\":\"6.1.130\",\"matchCriteriaId\":\"86AE0DF6-343B-48D2-8ABB-4787E7E7DD38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.8\",\"versionEndExcluding\":\"6.6.80\",\"matchCriteriaId\":\"B57B2C25-D9FD-43A9-8094-CEAF6874F65A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.17\",\"matchCriteriaId\":\"15370AEE-6D1C-49C3-8CB7-E889D5F92B6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.5\",\"matchCriteriaId\":\"72E69ABB-9015-43A6-87E1-5150383CFFD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.10.211:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4984E31-DB63-4A46-BA66-9DE0977CDECB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15.150:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F2FB65FA-EA68-4974-8F77-9817CBD9E418\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24e8e4523d3071bc5143b0db9127d511489f7b3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/554736b583f529ee159aa95af9a0cbc12b5ffc96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/860ca5e50f73c2a1cef7eefc9d39d04e275417f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e5d99a4cf2e23c716b44862975548415fae5391\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f277e479eea3d1aa18bc712abe1d2bf3dece2e30\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f618aeb6cad2307e48a641379db610abcf593edf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-23T23:46:30+00:00",
      "cve": "CVE-2025-21844",
      "id": "CVE-2025-21844",
      "initial_release_date": "2025-03-12T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: Add check for next_buffer in receive_encrypted_standard()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21844.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:19:25Z",
      "cve": "CVE-2025-21844",
      "id": "CVE-2025-21844",
      "initial_release_date": "2025-03-12T15:24:01Z",
      "product_status:known_affected": "573",
      "product_status:known_not_affected": "103",
      "product_status:recommended": "478",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21844",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21844.json",
      "version": "48"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:38:00.594Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T12:04:02.128Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21844\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:26:41.993251Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:58:00.670Z\"}}], \"cna\": {\"title\": \"smb: client: Add check for next_buffer in receive_encrypted_standard()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The bug is in the SMB client\u0027s receive path (cifs_demultiplex_thread \\u2192 smb3_receive_transform \\u2192 receive_encrypted_standard), which parses an encrypted compounded SMB2/SMB3 response arriving from the remote server over TCP/445 or RDMA. The triggering input (a response with a non-zero NextCommand) comes entirely from the remote peer, so the vulnerable code is reached across the network.\\nAC:L - A malicious or compromised SMB server reliably reaches the allocation by simply returning a compounded encrypted response with NextCommand set, and can drive the client toward buffer-pool exhaustion with large/compounded responses and many outstanding requests, retrying indefinitely until an allocation fails. No memory-layout or timing condition outside the attacker\u0027s influence is needed.\\nPR:N - The attacker is the SMB server (or a compromised legitimate server) and needs no account, credentials, or any privilege level on the victim client system. Nothing on the client-side path performs a privilege check before the demultiplex thread parses the response.\\nUI:N - Once a share is mounted \\u2014 including long-lived mounts, automounts, or a server that is compromised after the mount \\u2014 the server can send the malicious compounded response at any time with no action by any user on the client. Response processing happens asynchronously in the cifsd kernel thread, independent of user activity.\\nS:U - The NULL dereference occurs in kernel context on the client and its impact is confined to that kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:N - cifs_buf_get()/cifs_small_buf_get() returning NULL leads to memcpy() into a NULL destination, which faults immediately on the unmapped zero page; no kernel memory is read out or exposed to the attacker.\\nI:N - The faulting write targets address 0 and is aborted by the page fault handler, so no kernel data structure is modified and no control-flow hijack primitive is produced.\\nA:H - The unchecked NULL dereference causes a kernel oops in the cifsd demultiplex thread, tearing down the connection handling and typically panicking the system (or on panic_on_oops/hardened configurations, halting it), which is a full denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b03c8099a738a04d2343547ae6a04e5f0f63d3fa\", \"lessThan\": \"f277e479eea3d1aa18bc712abe1d2bf3dece2e30\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"858e73ff25639a0cc1f6f8d2587b62c045867e41\", \"lessThan\": \"f618aeb6cad2307e48a641379db610abcf593edf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9f528a8e68327117837b5e28b096f52af4c26a05\", \"lessThan\": \"24e8e4523d3071bc5143b0db9127d511489f7b3b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"534733397da26de0303057ce0b93a22bda150365\", \"lessThan\": \"9e5d99a4cf2e23c716b44862975548415fae5391\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eec04ea119691e65227a97ce53c0da6b9b74b0b7\", \"lessThan\": \"a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eec04ea119691e65227a97ce53c0da6b9b74b0b7\", \"lessThan\": \"554736b583f529ee159aa95af9a0cbc12b5ffc96\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eec04ea119691e65227a97ce53c0da6b9b74b0b7\", \"lessThan\": \"860ca5e50f73c2a1cef7eefc9d39d04e275417f7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.211\", \"lessThan\": \"5.10.235\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.150\", \"lessThan\": \"5.15.179\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.69\", \"lessThan\": \"6.1.130\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.8\", \"lessThan\": \"6.6.80\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/smb/client/smb2ops.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.235\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.179\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.130\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.80\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.17\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/client/smb2ops.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f277e479eea3d1aa18bc712abe1d2bf3dece2e30\"}, {\"url\": \"https://git.kernel.org/stable/c/f618aeb6cad2307e48a641379db610abcf593edf\"}, {\"url\": \"https://git.kernel.org/stable/c/24e8e4523d3071bc5143b0db9127d511489f7b3b\"}, {\"url\": \"https://git.kernel.org/stable/c/9e5d99a4cf2e23c716b44862975548415fae5391\"}, {\"url\": \"https://git.kernel.org/stable/c/a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd\"}, {\"url\": \"https://git.kernel.org/stable/c/554736b583f529ee159aa95af9a0cbc12b5ffc96\"}, {\"url\": \"https://git.kernel.org/stable/c/860ca5e50f73c2a1cef7eefc9d39d04e275417f7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: Add check for next_buffer in receive_encrypted_standard()\\n\\nAdd check for the return value of cifs_buf_get() and cifs_small_buf_get()\\nin receive_encrypted_standard() to prevent null pointer dereference.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.235\", \"versionStartIncluding\": \"5.10.211\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.179\", \"versionStartIncluding\": \"5.15.150\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.130\", \"versionStartIncluding\": \"6.1.69\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.80\", \"versionStartIncluding\": \"6.6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.17\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.5\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:54:52.911Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21844\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:54:52.911Z\", \"dateReserved\": \"2024-12-29T08:45:45.778Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-03-12T09:42:00.435Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.