BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-11-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: transport_ipc: validate payload size before reading handle handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Validate the size before dereferencing. This is a minimal fix to guard the initial handle read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-29

Last Modified

2025-11-03

Generated

2026-07-06

AI Q&A

2025-10-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-40084

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Linux kernel's ksmbd component, specifically in the transport_ipc module. The function handle_response() reads a 4-byte handle from a payload without first verifying that the payload size is at least 4 bytes. If a malformed or truncated message is received, this can cause the function to read beyond the actual payload size, potentially leading to memory corruption or other unintended behavior. The fix involves validating the payload size before reading the handle.

Impact Analysis

The vulnerability can lead to a 4-byte read past the declared payload size when processing malformed or truncated messages. This could cause memory corruption, which might be exploited to cause crashes, data leaks, or potentially arbitrary code execution depending on the context and further exploitation.

Hi! I’m here to help you understand CVE-2025-40084. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70