CVE-2025-22039

What it actually does

Integer overflow in dacloffset field (previously signed int) bypasses bounds checks in smb_check_perm_dacl() and smb_inherit_dacl() via unchecked addition, enabling out-of-bounds memory access and kernel crash on DACL pointer dereference.

Why it matters to the business

Systems running the vulnerable kernel module may experience unexpected crashes or denial of service when handling certain SMB requests, potentially disrupting file sharing services and requiring restarts; widespread kernel deployments increase exposure surface.

How an attack unfolds

An attacker sends a crafted SMB packet containing a specially chosen dacloffset value that triggers signed integer overflow during addition, bypassing the existing bounds check and causing the kernel to dereference an invalid DACL pointer leading to a crash.

How to fix it

Upgrade affected packages to the listed fixed versions: thunderbird (Red Hat:rhel_eus:9.2::appstream) to 0:128.4.0-1.el9_2 and equivalent debug packages; apply kernel commit 6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dc or later stable releases that convert dacloffset to unsigned int and add check_add_overflow() validation.

How to confirm the fix worked

Confirm kernel source contains the unsigned int conversion and check_add_overflow() usage in the relevant DACL functions; verify package versions match the fixed releases and test SMB DACL operations do not crash under boundary conditions.

Typical attack path

1. Identify a target system exposing ksmbd over SMB
2. Craft an SMB request with malicious dacloffset value designed to overflow
3. Send the request to smb_check_perm_dacl() or smb_inherit_dacl() paths
4. Trigger out-of-bounds access resulting in kernel panic or crash

How to detect it

Review kernel logs for oops/panic entries mentioning dacloffset, smb_check_perm_dacl, or smb_inherit_dacl; inspect SMB traffic captures for anomalous DACL offset values; correlate with ksmbd process crashes.

What your security team should do

• Prioritize kernel and ksmbd updates on all exposed systems within the next patching cycle
• Disable ksmbd if SMB server functionality is not required
• Monitor for kernel oops or panic logs related to DACL handling
• Apply network segmentation to limit SMB exposure from untrusted sources