CVE-2025-40099
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In the Linux kernel, the CIFS module's parse_dfs_referrals function lacks input validation for SMB server replies. A malicious server can send a reply smaller than expected or with an invalid number of referrals, causing an out-of-bounds memory read.
Risk Assessment
An attacker can remotely crash the system or potentially access sensitive kernel memory by exploiting the out-of-bounds read.
Recommendation
Apply the Linux kernel patch for CVE-2025-40099 that adds validation of server replies and returns -EINVAL on malformed input.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of referrals smaller than NumberOfReferrals in the header Processing of such replies will cause oob. Return -EINVAL error on such replies to prevent oob-s.