CVE-2025-21660

What it actually does

Unrestored path buffer after error in ksmbd_vfs_kern_path_locked allows subsequent file creation to use an attacker-controlled or altered path instead of the intended one, enabling path traversal for file operations.

Why it matters to the business

Attackers may create or overwrite files in unauthorized locations on Linux systems running the affected kernel, potentially leading to data tampering, persistence mechanisms, or escalation in file-serving environments; high prevalence in enterprise Linux deployments increases exposure risk.

How an attack unfolds

An attacker interacts with the ksmbd SMB server by sending a sequence of requests that trigger an error condition in path resolution before the final entry; the kernel fails to restore the modified path buffer, so a later creation operation uses the altered path, enabling traversal to unintended filesystem locations. No widespread threat actor campaigns noted for this specific issue.

How to fix it

Upgrade the Linux kernel to a fixed version such as 6.1.125 or the commit 13e41c58c74baa71f34c0830eaa3c29d53a6e964; for Red Hat JBCS packages apply the listed updates including jbcs-httpd24-httpd 0:2.4.6-77.SP1.jbcs.el6/el7 and equivalent for all listed httpd, mod_*, and debug/devel packages.

How to confirm the fix worked

Verify kernel version matches or exceeds fixed releases; confirm absence of the vulnerable ksmbd_vfs_kern_path_locked path handling logic via source inspection or package changelog; test SMB file creation paths under error conditions to ensure buffer restoration occurs.

Typical attack path

1. Establish SMB connection to ksmbd server on vulnerable Linux kernel
2. Send crafted path resolution requests that induce non-final-entry error in ksmbd_vfs_kern_path_locked
3. Trigger subsequent file creation operation that consumes the unrestored path buffer
4. Achieve creation of file at traversed or unexpected location

How to detect it

Review kernel and SMB audit logs for unexpected file creation attempts following path resolution errors; inspect ksmbd-related error paths and subsequent open/create calls for mismatched filenames; correlate with filesystem monitoring for files appearing outside expected directories.

What your security team should do

• Prioritize kernel upgrades on all systems exposing ksmbd/SMB services within 30 days given publication age
• Apply Red Hat JBCS package fixes where those components are in use
• Restrict SMB access to trusted networks and disable ksmbd if not required
• Monitor for unusual file creation events in shared directories