CVE-2025-37956

What it actually does

ksmbd SMB server in the Linux kernel accepts an empty newname string in rename requests, triggering a NULL dereference or invalid pointer use inside d_alloc that results in a kernel oops.

Why it matters to the business

Systems running the ksmbd kernel module can be forced into a crash, producing denial-of-service conditions that interrupt file-sharing services and require manual recovery or reboot.

How an attack unfolds

An attacker establishes an SMB session to a target running ksmbd, issues a rename operation supplying an empty newname field, and the server code path calls d_alloc on the empty string, causing the kernel fault.

How to fix it

Upgrade the Linux kernel to a build containing commit 6ee551672c8cf36108b0cfba92ec0c7c28ac3439 or later; apply the corresponding fixed packages for any distribution kernels that include ksmbd.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or patched release; attempt a rename operation with an empty target name from an SMB client and verify the server returns an error instead of oopsing.

Typical attack path

1. Establish authenticated or guest SMB session to ksmbd
2. Send SMB2 rename request containing an empty newname string
3. Trigger d_alloc on the malformed name, producing kernel oops

How to detect it

Review kernel logs for oops/panic entries containing ksmbd and d_alloc; inspect SMB audit logs for rename requests that carry zero-length newname fields.

What your security team should do

• Prioritize kernel updates on all systems exposing ksmbd
• Disable ksmbd in kernel configuration when SMB server functionality is not required
• Monitor for kernel oops entries referencing ksmbd and d_alloc