CVE-2025-22037
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
In the Linux kernel, in ksmbd, there is a null pointer dereference in alloc_preauth_hash(). The client sends a malformed SMB2 negotiate request, ksmbd returns an error, but the client can then send an SMB2 session setup even though conn->preauth_info is not allocated. The patch adds the KSMBD_SESS_NEED_SETUP connection status to ignore session setup requests if the SMB2 negotiate phase is not complete.
Risk Assessment
Risk of system panic or unexpected kernel behavior due to null pointer dereference, potentially leading to denial of service.
Recommendation
Apply the Linux kernel patch that adds the KSMBD_SESS_NEED_SETUP status check, or update the kernel to a version containing this fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete.