Critical 9.4Published Oct 4, 2025

CVE-2025-39943ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer

Updated under an hour ago (Oct 28, 2026, 8:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done.

CVSS: 9.4 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2ea086e35c3d726a3bacd0a971c1f02a50e98206 before 773fddf976d282ef059c36c575ddb81567acd6bc; from 2ea086e35c3d726a3bacd0a971c1f02a50e98206 before bdaab5c6538e250a9654127e688ecbbeb6f771d5; from 2ea086e35c3d726a3bacd0a971c1f02a50e98206 before eb0378dde086363046ed3d7db7f126fc3f76fd70; from 2ea086e35c3d726a3bacd0a971c1f02a50e98206 before 8be498fcbd5b07272f560b45981d4b9e5a2ad885; from 2ea086e35c3d726a3bacd0a971c1f02a50e98206 before 529b121b00a6ee3c88fb3c01b443b2b81f686d48; from 2ea086e35c3d726a3bacd0a971c1f02a50e98206 before 5282491fc49d5614ac6ddcd012e5743eecb6a67c	CNA record
linux linux_kernel linux:linux_kernel	from 5.15.1 before 5.15.194; from 5.16 before 6.1.154; from 6.2 before 6.6.108; from 6.7 before 6.12.49; from 6.13 before 6.16.9; 5.15; 5.15; 6.17; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/773fddf976d282ef059c36c575ddb81567acd6bc	patch
https://git.kernel.org/stable/c/bdaab5c6538e250a9654127e688ecbbeb6f771d5	patch
https://git.kernel.org/stable/c/eb0378dde086363046ed3d7db7f126fc3f76fd70	patch
https://git.kernel.org/stable/c/8be498fcbd5b07272f560b45981d4b9e5a2ad885	patch
https://git.kernel.org/stable/c/529b121b00a6ee3c88fb3c01b443b2b81f686d48	patch
https://git.kernel.org/stable/c/5282491fc49d5614ac6ddcd012e5743eecb6a67c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.