CVE-2025-22037

What it actually does

CVE-2025-22037 is a Linux kernel ksmbd flaw in SMB2 connection state handling. A malformed SMB2 NEGOTIATE request can cause ksmbd to return an error before allocating conn->preauth_info, but the connection may still accept a subsequent SMB2 SESSION_SETUP request. When ksmbd later attempts to use the missing pre-authentication hash state in alloc_preauth_hash(), it can dereference a NULL pointer, causing a kernel oops or crash. The practical impact is denial of service against systems running the in-kernel SMB server, especially where TCP/445 is reachable by untrusted clients.

Why it matters to the business

An attacker who can reach the SMB service can potentially crash the affected Linux system or disrupt file-sharing services without authentication. For organizations using Linux-based SMB file servers, NAS appliances, storage gateways, or embedded products built on affected kernels, exploitation could interrupt shared drive access, application dependencies, backups, user productivity, and service availability. Although this is not listed in CISA KEV and no public exploit maturity is indicated, the EPSS score is elevated, so internet- or broadly network-exposed ksmbd services should be treated as a priority availability risk.

How an attack unfolds

An attacker first identifies a host exposing ksmbd over SMB, typically on TCP port 445. The attacker opens an SMB2 connection and sends a malformed SMB2 NEGOTIATE request that causes the server-side negotiation phase to fail before pre-authentication state is allocated. Instead of completing negotiation correctly, the attacker then sends an SMB2 SESSION_SETUP request on the same connection. On vulnerable kernels, ksmbd may process this request even though the connection has not completed the required negotiate phase. The code path reaches alloc_preauth_hash() and attempts to operate on unallocated preauth_info state, triggering a NULL pointer dereference in kernel context. Depending on kernel panic/oops settings and service supervision, the result may be a ksmbd worker failure, service disruption, or full system crash/reboot.

How to fix it

Upgrade affected Linux kernels to versions containing the ksmbd fix that enforces connection state and ignores SESSION_SETUP requests when SMB2 negotiation has not completed. For source-based kernel consumers, include stable Linux commit cce57cd8c5dead24127cf2308fdd60fcad2d6ba6 or the corresponding backport from the relevant stable branch. For Red Hat package streams listed in the input, apply the vendor-provided fixed package version 0:128.4.0-1.el8_4 where applicable, but validate whether the vulnerable component in the deployed environment is actually the Linux kernel ksmbd module rather than an unrelated package listing. If immediate patching is not possible, disable ksmbd if not required, restrict TCP/445 to trusted networks and authenticated VPN paths, block internet exposure, and use firewall rules or segmentation to prevent untrusted clients from reaching SMB services.

How to confirm the fix worked

Confirm exposure by checking whether ksmbd is enabled or loaded and whether the host listens on TCP/445. On Linux systems, validate with commands such as lsmod | grep ksmbd, systemctl status ksmbd, ss -lntp | grep ':445', and kernel package/version inventory against vendor advisories. Confirm remediation by verifying that the running kernel includes the fixed stable commit or a vendor kernel with the corresponding backport; a package being installed is not sufficient unless the fixed kernel is the running kernel after reboot. Review dmesg, journalctl -k, and system logs for ksmbd-related NULL pointer dereferences before and after patching. In test environments only, a controlled SMB2 protocol negative test can verify that SESSION_SETUP after failed NEGOTIATE is rejected rather than processed.

Typical attack path

1. Scan for systems exposing SMB over TCP/445 or otherwise reachable ksmbd services.
2. Establish a TCP session to the SMB service.
3. Send a malformed SMB2 NEGOTIATE request that causes ksmbd to return an error before allocating pre-authentication hash state.
4. Keep or quickly reuse the connection and send an SMB2 SESSION_SETUP request despite the failed negotiation phase.
5. Trigger a NULL pointer dereference in alloc_preauth_hash() when ksmbd processes the invalid session setup sequence.
6. Cause denial of service through a kernel oops, ksmbd disruption, system instability, or crash depending on kernel configuration.

How to detect it

Investigate possible exploitation by correlating network, kernel, and availability telemetry. Review firewall, NetFlow, Zeek, Suricata, packet capture, load balancer, and host logs for SMB traffic to TCP/445 where a client sends malformed or failed SMB2 NEGOTIATE traffic followed by SMB2 SESSION_SETUP on the same connection. On hosts, inspect dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, and crash dumps for kernel NULL pointer dereferences involving ksmbd or alloc_preauth_hash. Look for sudden service failure, kernel oops, panic, reboot, watchdog reset, or storage service outage immediately after inbound SMB connections. If packet captures are available, focus on SMB2 command sequence anomalies: NEGOTIATE failure followed by SESSION_SETUP without a successful negotiation. Because exploitation is denial-of-service oriented, there may be no persistent file artifact or malware indicator; absence of files or processes does not rule out exploitation.

• ksmbd
• alloc_preauth_hash
• BUG: kernel NULL pointer dereference
• Oops: 0000
• RIP: .*alloc_preauth_hash
• RIP: .*ksmbd
• smb2 session setup
• SMB2 SESSION_SETUP
• SMB2 NEGOTIATE
• TCP/445
• kernel NULL pointer dereference.*ksmbd
• journalctl -k.*ksmbd
• /var/log/kern.log
• /var/log/messages
• /proc/modules.*ksmbd

What your security team should do

• Prioritize patching or backporting the ksmbd fix on any Linux SMB server reachable from untrusted networks, branch networks, partner networks, or the internet.
• Inventory systems using the in-kernel ksmbd server; do not assume all Samba servers are affected, because this issue is specific to Linux kernel ksmbd.
• Restrict TCP/445 exposure with host firewalls, network ACLs, and segmentation so only required clients can reach SMB services.
• Disable ksmbd where Linux SMB file sharing is not business-critical or where user-space Samba can be used as an alternative after risk review.
• Review kernel logs for historical crashes or oops events involving ksmbd, alloc_preauth_hash, SMB2 NEGOTIATE, or SMB2 SESSION_SETUP.
• Create SIEM detections for repeated SMB negotiation failures followed by session setup attempts from the same source, especially when correlated with kernel oops, reboot, or service interruption events.
• Because the EPSS score is elevated despite no KEV listing, include this vulnerability in near-term vulnerability management cycles rather than deferring it as a low-priority denial-of-service issue.