ksmbd: fix overflow in dacloffset bounds check
cve-program · CVE-2025-22039
PublishedIn the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smb_check_perm_dacl() and smb_inherit_dacl(). This could result in out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer. This patch converts dacloffset to unsigned int and uses check_add_overflow() to validate access to the DACL.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2025-22039 · CVE overview and exploitation status
cve-program · CVE-2025-22039
- https://git.kernel.org/stable/c/abbb4ec41867f2cd1c971258e493893bf43bcbd3
- https://git.kernel.org/stable/c/8483d7b532be1d1bc149556a2fedf903868c6303
- https://git.kernel.org/stable/c/73f074fb5e139cd42ad75089abe4e28a49a30003
- https://git.kernel.org/stable/c/6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dc
- https://git.kernel.org/stable/c/6b8d379048b168a0dff5ab1acb975b933f368514
- https://git.kernel.org/stable/c/443b373a4df5a2cb9f7b8c4658b2afedeb16397f
- https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42
Related changes
Linked by CVE identifierNo related changes are available here.