GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40099 (GCVE-0-2025-40099)

Vulnerability from cvelistv5 – Published: 2025-10-30 09:48 – Updated: 2026-08-05 12:07
VLAI
Title
cifs: parse_dfs_referrals: prevent oob on malformed input
Summary
In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of referrals smaller than NumberOfReferrals in the header Processing of such replies will cause oob. Return -EINVAL error on such replies to prevent oob-s.
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < cfacc7441f760e4a73cc71b6ff1635261d534657 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 15c73964da9df994302f579ed14ee5fdbce7a332 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < bb0f2e66e1ac043a5b238f5bcab4f26f3c317039 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 6447b0e355562a1ff748c4a2ffb89aae7e84d2c9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 6.1.158 , ≤ 6.1.* (semver)
Unaffected: 6.6.114 , ≤ 6.6.* (semver)
Unaffected: 6.12.55 , ≤ 6.12.* (semver)
Unaffected: 6.17.5 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cfacc7441f760e4a73cc71b6ff1635261d534657",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "15c73964da9df994302f579ed14ee5fdbce7a332",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "bb0f2e66e1ac043a5b238f5bcab4f26f3c317039",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "6447b0e355562a1ff748c4a2ffb89aae7e84d2c9",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: parse_dfs_referrals: prevent oob on malformed input\n\nMalicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS\n\n- reply smaller than sizeof(struct get_dfs_referral_rsp)\n- reply with number of referrals smaller than NumberOfReferrals in the\nheader\n\nProcessing of such replies will cause oob.\n\nReturn -EINVAL error on such replies to prevent oob-s."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable parser operates directly on a FSCTL_DFS_GET_REFERRALS reply received from a remote SMB server over TCP/445, with both the buffer length (`OutputCount`) and the referral count attacker-controlled. A malicious, compromised, or MITM\u0027d server reaches this code purely over the network.\nAC:L - The server sends one well-formed V3 referral (so the in-bounds VersionNumber check passes) together with NumberOfReferrals=0xFFFF, and the loop deterministically walks ~2.2 MB past the allocation. No race, no heap grooming, no memory-layout dependency.\nPR:N - The attacker is the remote SMB peer and needs no credentials or account on the victim client; the client initiates the connection and parses the reply. A network MITM on an unsigned/unencrypted SMB session can inject the malformed referral response with no privileges at all.\nUI:N - On an existing DFS mount the `dfs_cache_refresh` delayed work re-issues referral requests on a timer and re-queues itself indefinitely, so a compromised or MITM\u0027d server triggers the parse with zero user action; reconnect/failover paths do the same.\nS:U - The out-of-bounds access is confined to the kernel\u0027s own heap within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Unbounded out-of-bounds read of up to ~2.2 MB of adjacent kernel heap, far beyond a \"few bytes\"; the harvested ServerType/ReferralEntryFlags/TimeToLive values are stored into DFS cache entries and exposed to any local user through world-readable (0644) /proc/fs/cifs/dfscache.\nI:L - There is no out-of-bounds write, but uncontrolled out-of-bounds heap contents are written into `dfs_info3_param` fields and propagated into the client\u0027s cached DFS referral state (ttl, srvtype, ref_flags), a limited corruption of kernel-side data that the fix explicitly prevents.\nA:H - The linear ~2.2 MB walk past a small kmalloc object can strike an unmapped page and oops the kernel \u2014 reliably so on small-memory embedded/IoT clients, hardened allocators, and KASAN builds \u2014 and each malicious reply additionally forces a ~3 MB kcalloc, repeatable on every automatic refresh."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:48.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cfacc7441f760e4a73cc71b6ff1635261d534657"
        },
        {
          "url": "https://git.kernel.org/stable/c/15c73964da9df994302f579ed14ee5fdbce7a332"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb0f2e66e1ac043a5b238f5bcab4f26f3c317039"
        },
        {
          "url": "https://git.kernel.org/stable/c/6447b0e355562a1ff748c4a2ffb89aae7e84d2c9"
        }
      ],
      "title": "cifs: parse_dfs_referrals: prevent oob on malformed input",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40099",
    "datePublished": "2025-10-30T09:48:05.859Z",
    "dateReserved": "2025-04-16T07:20:57.164Z",
    "dateUpdated": "2026-08-05T12:07:48.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40099",
      "date": "2026-09-16",
      "epss": "0.00382",
      "percentile": "0.31877"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40099\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-30T10:15:34.337\",\"lastModified\":\"2026-07-30T06:24:11.723\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: parse_dfs_referrals: prevent oob on malformed input\\n\\nMalicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS\\n\\n- reply smaller than sizeof(struct get_dfs_referral_rsp)\\n- reply with number of referrals smaller than NumberOfReferrals in the\\nheader\\n\\nProcessing of such replies will cause oob.\\n\\nReturn -EINVAL error on such replies to prevent oob-s.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"cfacc7441f760e4a73cc71b6ff1635261d534657\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"15c73964da9df994302f579ed14ee5fdbce7a332\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"bb0f2e66e1ac043a5b238f5bcab4f26f3c317039\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"6447b0e355562a1ff748c4a2ffb89aae7e84d2c9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.158\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.114\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.55\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.5\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.5}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15c73964da9df994302f579ed14ee5fdbce7a332\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6447b0e355562a1ff748c4a2ffb89aae7e84d2c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb0f2e66e1ac043a5b238f5bcab4f26f3c317039\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cfacc7441f760e4a73cc71b6ff1635261d534657\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:07:57+00:00",
      "cve": "CVE-2025-40099",
      "id": "CVE-2025-40099",
      "initial_release_date": "2025-10-30T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cifs: parse_dfs_referrals: prevent oob on malformed input",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40099.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:47:22Z",
      "cve": "CVE-2025-40099",
      "id": "CVE-2025-40099",
      "initial_release_date": "2025-10-31T00:25:02Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "774",
      "product_status:recommended": "418",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40099",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40099.json",
      "version": "34"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.