CVE-2025-39943: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-39943 Overview

CVE-2025-39943 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's ksmbd SMB Direct (smbdirect) transport layer. The flaw resides in the recv_done handler, which failed to validate the data_offset and data_length fields of the smb_direct_data_transfer structure. An authenticated local attacker able to interact with a ksmbd server that has SMB Direct enabled can trigger memory access outside allocated bounds, causing kernel information disclosure or denial of service.

Critical Impact
A local attacker with low privileges can trigger an out-of-bounds condition in the kernel ksmbd module, resulting in high confidentiality and availability impact on affected Linux systems.

Affected Products

Linux Kernel version 5.15 (including release candidate rc7)
Linux Kernel 6.17 release candidates rc1 through rc6
Linux distributions shipping ksmbd with SMB Direct (RDMA) support enabled

Discovery Timeline

2025-10-04 - CVE-2025-39943 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39943

Vulnerability Analysis

The vulnerability affects ksmbd, the in-kernel SMB3 server implementation, specifically its SMB Direct transport module that supports Remote Direct Memory Access (RDMA). SMB Direct improves performance for high-bandwidth workloads by transferring data with minimal CPU involvement.

Inside the recv_done completion callback, the kernel processes incoming smb_direct_data_transfer packets received over RDMA. The structure contains data_offset and data_length fields describing where payload data begins and how many bytes follow. Before the fix, the driver used these attacker-controlled values to compute pointers and payload sizes without confirming they fell within the received buffer.

When the fields are crafted to reference memory beyond the buffer, subsequent reads dereference out-of-bounds addresses. The result is uninitialized or unrelated kernel memory being processed as SMB payload, which can leak kernel data or crash the system.

Root Cause

The root cause is missing input validation on protocol-supplied length and offset fields. The recv_done path trusted data_offset and data_length values from the wire without bounding them against the received message size. The upstream patch adds explicit validation in recv_done, rejecting packets whose offset or length would place the payload outside the receive buffer.

Attack Vector

Exploitation requires local access with low privileges and an environment where ksmbd is running with SMB Direct enabled. An attacker sends a malformed smb_direct_data_transfer message with data_offset or data_length values that exceed the buffer size. The kernel then performs an out-of-bounds read while processing the transfer.

Because no public proof-of-concept is available and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, active exploitation has not been documented. Patch details are available in the Linux kernel stable commits.

Detection Methods for CVE-2025-39943

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ksmbd_smb_direct or recv_done in dmesg output
KASAN reports flagging out-of-bounds reads within the ksmbd module
Anomalous SMB Direct sessions from local or peer nodes with malformed transfer sizes

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on non-production kernels to surface out-of-bounds accesses during ksmbd testing
Audit installed kernel packages and match versions against vendor security bulletins referencing CVE-2025-39943
Inspect ksmbd configuration to confirm whether SMB Direct is enabled and exposed to untrusted networks or tenants

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on ksmbd crashes or oops signatures
Monitor SMB service availability and unexpected restarts of the ksmbd daemon
Track loaded kernel modules on servers offering SMB shares to detect unauthorized enablement of ksmbd

How to Mitigate CVE-2025-39943

Immediate Actions Required

Apply the Linux kernel update containing the recv_done validation patch from your distribution vendor
If patching is not immediately possible, stop and disable the ksmbd service on systems that do not require in-kernel SMB serving
Restrict network exposure of ksmbd endpoints to trusted management segments only

Patch Information

The fix validates data_offset and data_length in recv_done before dereferencing them. Patch commits are published to the stable trees, including commit 5282491f, commit 529b121b, commit 773fddf9, commit 8be498fc, commit bdaab5c6, and commit eb0378dd. Rebuild or install updated kernel packages from your distribution.

Workarounds

Unload the ksmbd kernel module where SMB serving is not required: modprobe -r ksmbd
Disable SMB Direct (RDMA) support in ksmbd configuration to remove the vulnerable code path
Use host firewall rules to block SMB Direct traffic (typically TCP/5445) from untrusted sources

bash

# Configuration example: disable and mask ksmbd on systemd-based distributions
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo systemctl mask ksmbd.service

# Prevent the module from loading at boot
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
sudo update-initramfs -u