CVE-2025-22037
HIGH
ACT NOW
Priority: 5.21
BB Relevance:
85/100
Published: 2025-04-16
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete.
Weakness Classification (1)
Affected Software (8)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | 0626e6641f6b467447c81dd7678a69c66f7746cf < 2d3461d6ae74ebdcd4d65128c855198649bcadcd |
| Linux | Linux | 0626e6641f6b467447c81dd7678a69c66f7746cf < cce57cd8c5dead24127cf2308fdd60fcad2d6ba6 |
| Linux | Linux | 0626e6641f6b467447c81dd7678a69c66f7746cf < ca8bed31edf728a662ef9d6f39f50e7a7dc2b5ad |
| Linux | Linux | 0626e6641f6b467447c81dd7678a69c66f7746cf < 8f216b33a5e1b3489c073b1ea1b3d7cb63c8dc4d |
| Linux | Linux | 0626e6641f6b467447c81dd7678a69c66f7746cf < b8eb243e670ecf30e91524dd12f7260dac07d335 |
| Linux | Linux | 0626e6641f6b467447c81dd7678a69c66f7746cf < c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780 |
| Linux | Linux | 5.15 |
| linux | linux_kernel | 6.6 – 6.6.107 |