Security readout for executives and security teams
Plain-English summary
A flaw in Linux's in-kernel SMB server, ksmbd, can access memory outside an expected buffer when processing malformed security-descriptor data. The supplied CVSS score is 8.8 because a low-privileged network user may trigger serious confidentiality, integrity, and availability impacts. Systems not using ksmbd are unlikely to be exposed.
Executive priority
Prioritize rapid remediation for systems running reachable ksmbd, especially internet-facing or broadly accessible file servers. Schedule expedited kernel updates and reboot coordination because exploitation could affect sensitive data and service availability. Systems without ksmbd should still be inventoried and documented, but they are lower priority for this specific issue.
Technical view
parse_sec_desc() insufficiently validated owner SID, group SID, and DACL offsets against the SMB security-descriptor size. SID validation also failed to ensure the sub-authority array was fully contained. Crafted input could therefore cause slab out-of-bounds access. The cited Linux stable commits add the resolved checks; the bundle does not establish code execution.
Likely exposure
Exposure requires a vulnerable Linux kernel with ksmbd enabled and reachable. The CVSS vector indicates network access, low complexity, low privileges, and no user interaction. The bundle lists several affected releases, but its anomalous “0” entry and repeated commit identifiers make exact version-range interpretation unreliable; confirm status through the Linux or distribution vendor.
Exploitation context
The supplied record says this issue can cause slab out-of-bounds access and models high impact across confidentiality, integrity, and availability. It is not listed in CISA KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. Treat exploitability as plausible but operational status as unconfirmed.
Researcher notes
The root issue is incomplete bounds validation for security-descriptor offsets and SID sub-authority arrays. The CVSS vector supports remote, authenticated, low-complexity triggering, but does not prove practical exploitation or code execution. Exact affected and fixed release boundaries are unclear from the supplied version metadata; use the cited commits and distribution backport information for authoritative mapping.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable cited stable fix.
- Consult the Linux distribution's advisory for package-specific fixed versions.
- Disable ksmbd where SMB server functionality is unnecessary.
- Restrict SMB access to trusted networks and authenticated users until patched.
- Reboot into the updated kernel after package installation.
Validation and detection
- Identify running kernel versions on systems providing SMB services.
- Confirm whether ksmbd is loaded, enabled, or listening for SMB connections.
- Compare deployed kernel packages with vendor advisories and cited stable commits.
- After updating, verify systems booted into the corrected kernel.
- Recheck that SMB exposure is limited to intended networks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21946 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f4ee19528664777af8b842f8f001be98345aa973CVE reference, Linux
- https://git.kernel.org/stable/c/c1569dbbe2d43041be9f3fef7ca08bec3b66ad1bCVE reference, Linux
- https://git.kernel.org/stable/c/159d059cbcb0e6d0e7a7b34af3862ba09a6b22d1CVE reference, Linux
- https://git.kernel.org/stable/c/6a9831180d0b23b5c97e2bd841aefc8f82900172CVE reference, Linux
- https://git.kernel.org/stable/c/d6e13e19063db24f94b690159d0633aaf72a0f03CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.