Security readout for executives and security teams
Plain-English summary
This is a Linux kernel ksmbd flaw where an allocation failure is not checked before later memory access. On affected systems, a low-privileged local attacker could potentially cause integrity or availability impact. It matters most for Linux hosts using the in-kernel SMB server component.
Executive priority
Treat as high priority for Linux servers where ksmbd is used or local user access is common. Prioritize standard kernel patching, but do not frame this as confirmed active exploitation from the supplied sources.
Technical view
The bug is in ksmbd smb2_send_interim_resp(). If ksmbd_alloc_work_struct() returns NULL, later handling can write through in_work->response_buf, causing illegal memory access. The CVSS vector is local, low complexity, low privileges, no user interaction, with high integrity and availability impact.
Likely exposure
Exposure is most likely on Linux systems running affected kernel builds with ksmbd present or enabled. Systems using vendor kernels should map their package version to vendor advisories, because the source bundle lists upstream stable commits and Debian LTS guidance rather than every distribution build.
Exploitation context
The source bundle does not show CISA KEV listing or any cited evidence of active exploitation. The CVSS vector indicates local access with low privileges is required, so this is not presented as a remote unauthenticated SMB exploit based on the provided evidence.
Researcher notes
Evidence supports a missing NULL return check in ksmbd with CWE-476 characteristics and local PR:L exploitation conditions. The affected-version data is upstream-oriented and partly distribution-dependent, so validation should rely on vendor package advisories and referenced stable commits.
Mitigation direction
- Apply vendor kernel updates that include the referenced upstream stable fixes.
- Review Debian LTS guidance if running affected Debian kernel packages.
- If ksmbd is unnecessary, follow vendor guidance for disabling that component.
- Track distribution advisories for backported fixes, not only upstream version numbers.
Validation and detection
- Inventory Linux kernel versions across servers and appliances.
- Identify systems where the ksmbd kernel SMB server is installed, loaded, or enabled.
- Map each kernel package to vendor advisories or fixed stable commits.
- Prioritize validation on multi-user systems where local low-privileged access exists.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 781c743e18bfd9b7dc0383f036ae952bd1486f21
- Linux stable commit ee7e40f7fb17f08a8cbae50553e5c2e10ae32fce
- Linux stable commit 271ae0edbfc942795c162e6cf20d2bc02bd7fde4
- Linux stable commit 2976e91a3e569cf2c92c9f71512c0ab1312fe965
- Linux stable commit 4c16e1cadcbcaf3c82d5fc310fbd34d0f5d0db7c
- Debian LTS announcement
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-57925 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/781c743e18bfd9b7dc0383f036ae952bd1486f21CVE reference, Linux
- https://git.kernel.org/stable/c/ee7e40f7fb17f08a8cbae50553e5c2e10ae32fceCVE reference, Linux
- https://git.kernel.org/stable/c/271ae0edbfc942795c162e6cf20d2bc02bd7fde4CVE reference, Linux
- https://git.kernel.org/stable/c/2976e91a3e569cf2c92c9f71512c0ab1312fe965CVE reference, Linux
- https://git.kernel.org/stable/c/4c16e1cadcbcaf3c82d5fc310fbd34d0f5d0db7cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.