CVE-2025-22042

What it actually does

Missing bounds check on create lease context in ksmbd allows out-of-bounds memory access leading to kernel crash or denial of service.

Why it matters to the business

Local users on affected Linux systems can cause unplanned downtime and service interruption; prevalence in enterprise distributions increases exposure for organizations running file sharing workloads.

How an attack unfolds

An authenticated local attacker crafts a malicious SMB create request containing an oversized or malformed lease context structure, bypassing the absent bounds validation and triggering invalid memory access inside the kernel module.

How to fix it

Update the Linux kernel to the fixed commit 629dd37acc336ad778979361c351e782053ea284 or apply the corresponding vendor patch; for listed Red Hat packages update to the versions ending in 0:2.62.3-2.el8_6.1.

How to confirm the fix worked

Confirm kernel version or package version meets or exceeds the fixed release; attempt to load ksmbd and exercise lease context creation paths under test conditions to verify stability.

Typical attack path

1. Obtain local user access on a system running the vulnerable ksmbd module
2. Connect to the SMB share and issue a crafted create request with invalid lease context length
3. Trigger kernel memory access violation resulting in denial of service

How to detect it

Review kernel logs for oops or panic entries mentioning lease context or ksmbd; inspect SMB session creation attempts from local processes that precede crashes.

What your security team should do

• Prioritize patching systems that expose ksmbd to untrusted local users
• Monitor for kernel oops or panic logs related to lease context handling
• Restrict local access to SMB shares until updates are applied