CVE-2025-22043

What it actually does

Missing bounds check on durable handle context in ksmbd allows out-of-bounds memory access during SMB request processing in the Linux kernel.

Why it matters to the business

Systems using the Linux kernel SMB server face potential crashes or memory corruption that could lead to downtime or unauthorized access, though exploitation likelihood remains low with no known campaigns or ransomware use; patch promptly on affected distributions to avoid future risk.

How an attack unfolds

An attacker crafts an SMB request containing a durable handle context that violates expected size limits, sends it to a ksmbd-enabled server, and triggers the missing validation to cause invalid memory operations in the kernel.

How to fix it

Apply the upstream kernel fix from commit 8d4848c45943c9cf5e86142fd7347efa97f497db; on Red Hat Enterprise Linux 9 update NetworkManager-libreswan packages to version 1.2.22-4.el9_5 or later; disable ksmbd module if SMB server functionality is not required.

How to confirm the fix worked

Confirm kernel source contains commit 8d4848c45943c9cf5e86142fd7347efa97f497db, verify package versions match the fixed releases listed for each distribution, and re-test SMB durable handle operations with boundary test cases.

Typical attack path

1. Establish an SMB connection to a target running ksmbd
2. Send a session or tree connect request embedding an oversized durable handle context
3. Trigger kernel path that processes the context without bounds validation
4. Observe resulting memory corruption, crash, or potential code execution

How to detect it

Inspect kernel logs for oops or panic messages referencing ksmbd and durable handle context handling; review network captures for anomalous SMB packet structures with oversized context fields; correlate with unusual process terminations of smbd or kernel threads.

What your security team should do

• Prioritize kernel and package updates within the next maintenance window
• Disable ksmbd if SMB sharing is unnecessary
• Review network exposure of SMB ports and apply least-privilege firewall rules
• Monitor EPSS and KEV updates for any rise in exploit activity