CVE-2025-39975 (GCVE-0-2025-39975)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:55 – Updated: 2026-08-05 12:06
VLAI
Title
smb: client: fix wrong index reference in smb2_compound_op()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes. This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index is greather than or equal to MAX_COMPOUND, it can cause out-of-bounds accesses.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5ddcc9e92d54548219985ce4de88618fb53e14ec , < ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5 (git)
Affected: efe8db3ecaa40a8520dc9a54283dcecd82ceea9c , < bfb1e2aad1fecef8320fd71332acde0d53a8d699 (git)
Affected: 3681c74d342db75b0d641ba60de27bf73e16e66b , < 093615fc76063ea08d454ba86677ce64c736e806 (git)
Affected: 3681c74d342db75b0d641ba60de27bf73e16e66b , < fbe2dc6a9c7318f7263f5e4d50f6272b931c5756 (git)
Affected: 77aefd1d9b790f60634adebbdcfffbe934f41c34 (git)
Affected: 6.6.75 , < 6.6.109 (semver)
Affected: 6.12.12 , < 6.12.50 (semver)
Affected: 6.13.1 , < 6.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.6.109 , ≤ 6.6.* (semver)
Unaffected: 6.12.50 , ≤ 6.12.* (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5",
              "status": "affected",
              "version": "5ddcc9e92d54548219985ce4de88618fb53e14ec",
              "versionType": "git"
            },
            {
              "lessThan": "bfb1e2aad1fecef8320fd71332acde0d53a8d699",
              "status": "affected",
              "version": "efe8db3ecaa40a8520dc9a54283dcecd82ceea9c",
              "versionType": "git"
            },
            {
              "lessThan": "093615fc76063ea08d454ba86677ce64c736e806",
              "status": "affected",
              "version": "3681c74d342db75b0d641ba60de27bf73e16e66b",
              "versionType": "git"
            },
            {
              "lessThan": "fbe2dc6a9c7318f7263f5e4d50f6272b931c5756",
              "status": "affected",
              "version": "3681c74d342db75b0d641ba60de27bf73e16e66b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "77aefd1d9b790f60634adebbdcfffbe934f41c34",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.109",
              "status": "affected",
              "version": "6.6.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.50",
              "status": "affected",
              "version": "6.12.12",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "6.6.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "6.12.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix wrong index reference in smb2_compound_op()\n\nIn smb2_compound_op(), the loop that processes each command\u0027s response\nuses wrong indices when accessing response bufferes.\n\nThis incorrect indexing leads to improper handling of command results.\nAlso, if incorrectly computed index is greather than or equal to\nMAX_COMPOUND, it can cause out-of-bounds accesses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code parses SMB2 compound responses received over TCP/445 from the remote server, so a malicious, compromised, or on-path (unsigned/downgraded session) SMB server triggers it purely with network traffic. This matches the established scoring for fs/smb/client response-parsing flaws such as CVE-2026-46155 in this same function.\nAC:L - The server fully controls the per-command NT status codes and payload of each element in the compound chain, so it deterministically arranges \"CLOSE succeeds / QUERY_WSL_EA fails\" and shapes the error-response body that then gets parsed as an EA buffer. No race, memory-layout guess, or condition outside the attacker\u0027s control is involved.\nPR:N - The attacker is the server side of the connection (or an on-path injector) and needs no account or privilege on the victim client. Once the client has a session to the server, every subsequent path lookup drives the vulnerable parser.\nUI:N - On an already-mounted share (fstab, autofs/systemd automount, container image, or a server that was compromised after mount), ordinary background filesystem activity such as stat()/lookup reaches smb2_query_path_info() -\u003e smb2_compound_op() with no victim action. This matches UI:N used for the equivalent smb2_compound_op() EA parsing CVE.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own security authority on the client; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Treating an error response as a successful QUERY_INFO/QUERY_WSL_EA lets an attacker-chosen OutputBufferOffset/OutputBufferLength drive memcpy() past the end of the response allocation, copying adjacent kernel heap memory into idata-\u003ewsl.eas, which wsl_to_fattr() then exposes to userspace as file uid/gid/mode/rdev. This is an out-of-bounds kernel heap read with a user-visible channel.\nI:H - Command results are attributed to the wrong response buffer, so failed server operations are accepted as successful and inode state \u2014 attributes, reparse tag, and WSL-derived uid/gid/mode/rdev used for access decisions \u2014 is populated from an incorrect, attacker-shaped, partly out-of-bounds buffer. The wrong-index accesses into the rsp_iov array are a memory-safety error class that is not inherently read-limited.\nA:H - The out-of-bounds read past the response buffer can touch unmapped memory and oops the kernel, and parsing an error response as reparse/EA data produces garbage-driven kernel faults. Any such crash is a full availability loss for the client system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:43.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfb1e2aad1fecef8320fd71332acde0d53a8d699"
        },
        {
          "url": "https://git.kernel.org/stable/c/093615fc76063ea08d454ba86677ce64c736e806"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbe2dc6a9c7318f7263f5e4d50f6272b931c5756"
        }
      ],
      "title": "smb: client: fix wrong index reference in smb2_compound_op()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39975",
    "datePublished": "2025-10-15T07:55:56.951Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-08-05T12:06:43.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39975",
      "date": "2026-10-02",
      "epss": "0.00467",
      "percentile": "0.38196"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smb2inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5",
                    "status": "affected",
                    "version": "5ddcc9e92d54548219985ce4de88618fb53e14ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bfb1e2aad1fecef8320fd71332acde0d53a8d699",
                    "status": "affected",
                    "version": "efe8db3ecaa40a8520dc9a54283dcecd82ceea9c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "093615fc76063ea08d454ba86677ce64c736e806",
                    "status": "affected",
                    "version": "3681c74d342db75b0d641ba60de27bf73e16e66b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fbe2dc6a9c7318f7263f5e4d50f6272b931c5756",
                    "status": "affected",
                    "version": "3681c74d342db75b0d641ba60de27bf73e16e66b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "77aefd1d9b790f60634adebbdcfffbe934f41c34",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.109",
                    "status": "affected",
                    "version": "6.6.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.50",
                    "status": "affected",
                    "version": "6.12.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "affected",
                    "version": "6.13.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smb2inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix wrong index reference in smb2_compound_op()\n\nIn smb2_compound_op(), the loop that processes each command\u0027s response\nuses wrong indices when accessing response bufferes.\n\nThis incorrect indexing leads to improper handling of command results.\nAlso, if incorrectly computed index is greather than or equal to\nMAX_COMPOUND, it can cause out-of-bounds accesses."
          }
        ],
        "id": "CVE-2025-39975",
        "lastModified": "2026-07-30T06:24:03.460",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-15T08:15:35.273",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/093615fc76063ea08d454ba86677ce64c736e806"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bfb1e2aad1fecef8320fd71332acde0d53a8d699"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fbe2dc6a9c7318f7263f5e4d50f6272b931c5756"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:53:58+00:00",
      "cve": "CVE-2025-39975",
      "id": "CVE-2025-39975",
      "initial_release_date": "2025-10-15T00:00:00+00:00",
      "product_status:known_affected": "78",
      "product_status:known_not_affected": "196",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix wrong index reference in smb2_compound_op()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39975.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:16:16Z",
      "cve": "CVE-2025-39975",
      "id": "CVE-2025-39975",
      "initial_release_date": "2025-10-16T23:24:37Z",
      "product_status:known_not_affected": "523",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39975",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39975.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.