CVE-2025-22038

What it actually does

Out-of-bounds read in ksmbd when psid->sub_auth[psid->num_subauth-1] is accessed without validating that num_subauth is non-zero, allowing memory corruption on crafted SID structures.

Why it matters to the business

Kernel crashes or limited information disclosure can interrupt SMB file sharing services on affected Red Hat real-time Linux systems, with moderate urgency due to 560 days since publication and low but increasing exploit probability.

How an attack unfolds

An attacker sends a specially crafted SMB authentication or session setup request containing a SID structure with num_subauth set to zero; ksmbd then performs an unchecked array access leading to the out-of-bounds read.

How to fix it

Upgrade all listed kernel-rt packages on Red Hat Enterprise Linux 9.2 to version 5.14.0-284.92.1.rt14.377.el9_2 or later; apply the update across nfv and realtime variants and reboot.

How to confirm the fix worked

Verify running kernel version matches or exceeds the fixed release for each kernel-rt package; confirm absence of the vulnerable ksmbd SID handling code path via source inspection or vendor advisory.

Typical attack path

1. Establish SMB connection to ksmbd listener
2. Craft SID with num_subauth=0 in authentication blob
3. Send malformed request triggering sub_auth access
4. Observe kernel oops or read adjacent memory contents

How to detect it

Search kernel logs and ksmbd audit trails for oops or panic messages referencing SID sub_auth access or num_subauth; correlate with inbound SMB traffic from untrusted sources.

What your security team should do

• Prioritize patching all Red Hat 9.2 real-time kernel deployments within standard change windows
• Monitor for kernel oops reports involving ksmbd
• Review SMB exposure and restrict ksmbd to trusted networks where possible