CVE-2025-22038 Overview
CVE-2025-22038 is an out-of-bounds read vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the code path that accesses psid->sub_auth[psid->num_subauth - 1] without first validating that num_subauth is non-zero. When num_subauth equals zero, the subtraction underflows and the resulting index causes an out-of-bounds read against the sub_auth array. The vulnerability is classified as [CWE-125] Out-of-Bounds Read and affects multiple stable Linux kernel branches shipping the ksmbd module.
Critical Impact
A local authenticated attacker interacting with a ksmbd share can trigger an out-of-bounds read that discloses kernel memory or crashes the kernel, resulting in denial of service.
Affected Products
- Linux Kernel stable branches containing the ksmbd module prior to the fix commits
- Debian LTS distributions shipping the vulnerable kernel packages
- Any Linux distribution exposing ksmbd as an in-kernel SMB server
Discovery Timeline
- 2025-04-16 - CVE-2025-22038 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-22038
Vulnerability Analysis
The vulnerability exists in the ksmbd kernel module, which implements an SMB3 file server directly inside the Linux kernel. During processing of Security Identifier (SID) structures received from SMB clients, the code accesses the last entry of the sub_auth array using the expression psid->sub_auth[psid->num_subauth - 1]. The code does not verify that num_subauth is non-zero before performing the subtraction and array access. When an attacker supplies a SID with num_subauth set to zero, the index calculation wraps to a large unsigned value, producing an out-of-bounds read past the sub_auth array boundary.
An authenticated local user who can send crafted SMB requests to a ksmbd share can trigger the invalid read. The result is either disclosure of adjacent kernel memory contents or a kernel oops leading to service disruption. The patch introduced by the upstream maintainers adds an explicit validation step that rejects SIDs where num_subauth equals zero before the vulnerable dereference occurs.
Root Cause
The root cause is missing input validation on attacker-controlled protocol data. The ksmbd SID parsing routine trusted the num_subauth field from parsed SMB structures and used it as the basis for an unchecked array index calculation. A zero value combined with unsigned integer arithmetic produced an underflow, breaking the assumed invariant that num_subauth - 1 is a valid array index.
Attack Vector
Exploitation requires local access with low privileges and the ability to issue authenticated SMB operations against a ksmbd server. The attacker crafts a Security Descriptor or ACL blob containing a SID structure whose num_subauth field is zero. When ksmbd processes the malformed SID during authorization or ACL evaluation, the kernel dereferences memory outside the sub_auth array bounds.
No verified exploit code is publicly available for CVE-2025-22038. See the Linux Kernel Change Log for the authoritative fix and technical details.
Detection Methods for CVE-2025-22038
Indicators of Compromise
- Kernel oops or panic messages referencing ksmbd functions such as SID or ACL parsing routines in dmesg and journalctl output
- Unexpected ksmbd worker thread crashes correlated with incoming SMB sessions from specific clients
- KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads inside ksmbd modules on instrumented kernels
Detection Strategies
- Monitor kernel logs for ksmbd-related fault signatures and correlate with SMB client source IPs to identify probing activity
- Deploy audit rules that record process activity mounting or connecting to ksmbd shares from non-standard local accounts
- Inspect SMB packet captures on hosts running ksmbd for Security Descriptors containing SIDs with num_subauth = 0, which is not produced by legitimate clients
Monitoring Recommendations
- Forward kernel ring buffer messages and ksmbd service logs to a centralized logging platform for correlation and alerting
- Alert on repeated ksmbd process restarts or systemd unit failures, which may indicate exploitation attempts triggering kernel faults
- Track the kernel package version deployed across the fleet and flag hosts still running vulnerable builds
How to Mitigate CVE-2025-22038
Immediate Actions Required
- Apply the stable kernel updates from your distribution vendor that include the upstream ksmbdnum_subauth validation patches
- Disable the ksmbd module on hosts that do not require an in-kernel SMB server using modprobe -r ksmbd and blacklist it via /etc/modprobe.d/
- Restrict network access to ksmbd TCP port 445 to trusted management segments using host firewalls
Patch Information
The Linux kernel maintainers released fixes across multiple stable branches. Refer to the upstream commits: 0e36a3e0, 3ac65de1, 56de7778, 68c6c314, bf21e29d, and c8bfe195. Debian users should install the fixed packages per the Debian LTS Announcement.
Workarounds
- Unload the ksmbd module and switch to a userspace SMB server such as Samba until the kernel patch is deployed
- Limit ksmbd share access to authenticated principals over dedicated management VLANs to reduce the local attacker surface
- Enable KASAN or lockdown features on non-production kernels to detect malicious SID structures during triage
# Disable ksmbd until the patched kernel is installed
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
# Verify installed kernel version after patching
uname -r
apt list --installed 2>/dev/null | grep linux-image
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
