Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s ksmbd SMB server can corrupt memory on 32-bit systems when message-size calculations overflow. The supplied assessment rates it critical because network-based, unauthenticated exploitation could potentially compromise confidentiality, integrity, and availability. The sources do not establish real-world exploitation.
Executive priority
Urgently assess and patch 32-bit systems using ksmbd, prioritizing externally or broadly reachable SMB services. Systems that are 64-bit or do not use ksmbd are not identified as affected by the supplied description. Active exploitation is unconfirmed, so prioritize by verified exposure rather than CVSS alone.
Technical view
Integer additions in ksmbd’s ipc_msg_alloc() can overflow on 32-bit systems, causing an undersized allocation and potential memory corruption. The upstream correction adds bounds checking against KSMBD_IPC_MAX_PAYLOAD. The supplied CVSS 3.1 score is 9.8, with network access, low complexity, no privileges, and no user interaction.
Likely exposure
Exposure is most likely on 32-bit Linux systems using ksmbd, particularly where SMB is network-reachable. The supplied affected records span listed releases from 5.15 through 6.14, but their exact range is ambiguous. Distribution backports may alter exposure, so kernel version strings alone are insufficient.
Exploitation context
The supplied record is not in KEV, and no cited source reports active exploitation or a public exploit. The CVSS vector nevertheless describes unauthenticated network reachability and potentially complete confidentiality, integrity, and availability impact. Treat that as assessed potential, not proof of practical exploitation.
Researcher notes
The vulnerable condition is an arithmetic overflow in ipc_msg_alloc() on 32-bit architectures, followed by possible memory corruption. The correction uses KSMBD_IPC_MAX_PAYLOAD for bounds enforcement. The bundle does not document exploitability details, affected distribution package mappings, crash signatures, or whether specific ksmbd configurations change reachability.
Mitigation direction
- Install a vendor-supported kernel containing the referenced upstream bounds-checking fix.
- Prioritize 32-bit systems running ksmbd or exposing SMB to untrusted networks.
- Consult distribution security guidance when package versions differ from upstream kernel versions.
- If updating is delayed, obtain vendor guidance on supported temporary risk-reduction measures.
Validation and detection
- Inventory 32-bit Linux hosts and determine whether ksmbd is installed, loaded, or active.
- Identify network-reachable SMB services backed by ksmbd.
- Compare running kernel packages with vendor advisories and fixed package revisions.
- Confirm the installed kernel incorporates the applicable referenced stable-kernel correction.
- After updating, verify systems booted into the corrected kernel.
Public sources used
- CVE Program record for CVE-2025-21748
- CVE List V5 record
- Linux stable-kernel correction f3b9fb2
- Linux stable-kernel correction 760568c
- Linux stable-kernel correction 82f59d6
- Linux stable-kernel correction b4b9027
- Linux stable-kernel correction ecb9947
- Linux stable-kernel correction aab98e2
- Debian LTS security announcement
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21748 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f3b9fb2764591d792d160f375851013665a9e820CVE reference, Linux
- https://git.kernel.org/stable/c/760568c1f62ea874e8fb492f9cfa4f47b4b8391eCVE reference, Linux
- https://git.kernel.org/stable/c/82f59d64e6297f270311b16b5dcf65be406d1ea3CVE reference, Linux
- https://git.kernel.org/stable/c/b4b902737746c490258de5cb55cab39e79927a67CVE reference, Linux
- https://git.kernel.org/stable/c/ecb9947fa7c99a77b04d43404c6988a0d326e4a0CVE reference, Linux
- https://git.kernel.org/stable/c/aab98e2dbd648510f8f51b83fbf4721206ccae45CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.