CVE-2025-37947

What it actually does

Missing bounds check in ksmbd_vfs_stream_write allows an attacker-supplied write offset (*pos) >= existing stream length (v_len) to perform an out-of-bounds kernel memory write.

Why it matters to the business

Local attackers on affected Ubuntu systems can escalate privileges to root, compromising the entire host and any workloads or data it serves; the large number of long-supported package variants increases the exposed fleet size.

How an attack unfolds

An attacker with local access crafts a malicious SMB stream write request that supplies an offset beyond the allocated stream buffer; the unchecked *pos value causes the kernel to write attacker-controlled data into adjacent memory, enabling privilege escalation. Similar Linux kernel privilege-escalation techniques used by actors targeting CVE-2025-37797 and CVE-2025-37890 can be adapted.

How to fix it

Upgrade to the listed fixed package versions: linux 3.11.0-12.19 (14.04), 4.4.0-2.16 (16.04), 4.13.0-16.19 (18.04), 5.4.0-9.12 (20.04) and the corresponding linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oracle builds; reboot after installation.

How to confirm the fix worked

Verify the running kernel package version matches or exceeds the fixed version for the distribution release; confirm ksmbd is either disabled or the updated module is loaded.

Typical attack path

1. Obtain local shell on an affected Ubuntu system
2. Mount or connect to a ksmbd share and issue a crafted stream write with oversized *pos
3. Trigger the out-of-bounds write to corrupt kernel structures
4. Escalate to root via the resulting memory corruption
5. Install persistence or move laterally

How to detect it

Review kernel audit logs and SMB-related audit events for unusual stream-write operations; look for processes invoking ksmbd_vfs_stream_write or generating EINVAL returns on stream writes immediately preceding privilege-escalation indicators.

What your security team should do

• Prioritize patching of internet-facing or multi-tenant Ubuntu hosts running ksmbd
• Disable ksmbd where SMB server functionality is unnecessary
• Monitor for local privilege-escalation attempts on remaining unpatched systems
• Apply the exact fixed package versions listed for each Ubuntu release