ksmbd: fix null pointer dereference in alloc_preauth_hash()
Affects the Linux kernel ksmbd SMB server from 5.15.0 until fixed in 6.6.107, 6.12.23, 6.13.11 and 6.14.2 depending on branch. No vendor severity rating is given; CVSS is 7.5 (high).
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 6.6.107, 6.12.23, 6.13.11, 6.14.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The ksmbd in-kernel SMB server in the Linux kernel is affected. A malformed SMB2 negotiate request could leave the connection's preauthentication state unallocated, and a later session setup request could then trigger a null pointer dereference, potentially crashing the system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete.
Timeline
- CVE published
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
5.15
- KernelLinux
From 5.15.0 · fixed in 6.6.107; From 6.7.0 · fixed in 6.12.23; From 6.13.0 · fixed in 6.13.11; From 6.14.0 · fixed in 6.14.2
References 7
git.kernel.org
zerodayinitiative.com
Questions about CVE-2025-22037
What does this mean?
A null pointer dereference in alloc_preauth_hash() can occur when a client sends session setup before the preauth info has been allocated. The trigger described is a malformed SMB2 negotiate request, which ksmbd answers with an error response.Source: git.kernel.org
Am I affected, and how do I check?
The listed ranges are Linux kernel versions from 5.15.0 up to the fixed release for each branch: before 6.6.107, 6.7.0 through 6.12.23, 6.13.0 through 6.13.11, and 6.14.0 through 6.14.2. To check a system, run uname -r for the kernel version and confirm whether the ksmbd module is loaded.Source: git.kernel.org
What should I do about it?
Upgrade the kernel to the fixed release for your branch: 6.6.107, 6.12.23, 6.13.11 or 6.14.2. The facts provided do not list a workaround.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data