Transport IPC Vulnerability in Linux Kernel Affects Payload Handling

CVE-2025-40084

What is CVE-2025-40084?

The Linux kernel's ksmbd component has been identified with a vulnerability that allows for unsafe dereferencing of payload handles without adequate size checks. Specifically, the handle_response() function may read a 4-byte handle from a payload without confirming that the declared size is at least 4 bytes. This oversight can lead to potential exploitation through malformed or truncated messages from ksmbd.mountd, resulting in out-of-bounds reads. A critical patch has been introduced to validate the payload length before such dereferencing occurs, addressing this security gap effectively.

References