Review reviewHigh

CVE-2025-39943

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done.

CVSS: 7.1
EPSS: 0.24%
CISA KEV: Not listed
Published: 2025.10.04

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.24%

Technical severityCVSS 7.1

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= 2ea086e35c3d726a3bacd0a971c1f02a50e98206 < 773fddf976d282ef059c36c575ddb81567acd6bc, >= 2ea086e35c3d726a3bacd0a971c1f02a50e98206 < bdaab5c6538e250a9654127e688ecbbeb6f771d5, >= 2ea086e35c3d726a3bacd0a971c1f02a50e98206 < eb0378dde086363046ed3d7db7f126fc3f76fd70, >= 2ea086e35c3d726a3bacd0a971c1f02a50e98206 < 8be498fcbd5b07272f560b45981d4b9e5a2ad885, >= 2ea086e35c3d726a3bacd0a971c1f02a50e98206 < 529b121b00a6ee3c88fb3c01b443b2b81f686d48, >= 2ea086e35c3d726a3bacd0a971c1f02a50e98206 < 5282491fc49d5614ac6ddcd012e5743eecb6a67c, >= 5.15, >= 5.15.1 < 5.15.194, >= 5.16 < 6.1.154, >= 6.2 < 6.6.108, >= 6.7 < 6.12.49, >= 6.13 < 6.16.9, 5.15, 6.17
Fixed versions: 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE: CWE-125