Security readout for executives and security teams
Plain-English summary
A remote, unauthenticated client can crash a Linux system’s ksmbd file-sharing service by sending malformed SMB requests in an unexpected sequence. The primary impact is service or system availability; the supplied evidence does not indicate data theft or modification.
Executive priority
Treat this as a high-priority availability issue for reachable ksmbd servers, especially business-critical file-sharing systems. Patch promptly through supported kernel channels and reduce SMB exposure while updates are pending. Systems not using ksmbd are unlikely to be exposed to this specific flaw.
Technical view
A malformed SMB2 negotiate request can leave conn->preauth_info unallocated. A subsequent session-setup request reaches alloc_preauth_hash() and triggers a null-pointer dereference. The kernel fix introduces KSMBD_SESS_NEED_SETUP state handling, rejecting session setup until negotiation completes. CVSS 3.1 is 7.5: network-accessible, low complexity, unauthenticated, availability-only impact.
Likely exposure
Exposure requires Linux systems running ksmbd and accepting SMB connections from an attacker-controlled network. Internet-facing or broadly reachable SMB services warrant the fastest review. The supplied affected-version data is ambiguous, so determine exposure through vendor kernel guidance and fix-commit inclusion rather than version strings alone.
Exploitation context
The supplied record is not in CISA KEV, and the provided sources do not establish active exploitation. The network-accessible, unauthenticated denial-of-service condition is nevertheless practical enough to prioritize wherever ksmbd is reachable. No evidence supplied supports confidentiality or integrity impact.
Researcher notes
The affected-version entries in the supplied record contain duplicates, a value of “0,” and unclear boundaries. Avoid deriving precise vulnerable ranges from them. The core defect and correction are well described, but exploit prevalence is unsupported. Validate backports by commit or vendor advisory, not kernel version comparison alone.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix for CVE-2025-22037.
- Check distribution or appliance guidance because the supplied version boundaries are ambiguous.
- Disable ksmbd where SMB file sharing is unnecessary.
- Until patched, restrict SMB access to trusted networks and required clients only.
Validation and detection
- Inventory systems loading or running ksmbd and record their kernel package versions.
- Identify which ksmbd services are reachable from untrusted or internet-connected networks.
- Confirm the installed kernel includes the applicable referenced stable commit or vendor backport.
- Review kernel and service logs for ksmbd crashes or null-pointer faults.
- After updating, verify ksmbd operates normally and the intended SMB access restrictions remain enforced.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22037 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cce57cd8c5dead24127cf2308fdd60fcad2d6ba6CVE reference, Linux
- https://git.kernel.org/stable/c/ca8bed31edf728a662ef9d6f39f50e7a7dc2b5adCVE reference, Linux
- https://git.kernel.org/stable/c/8f216b33a5e1b3489c073b1ea1b3d7cb63c8dc4dCVE reference, Linux
- https://git.kernel.org/stable/c/b8eb243e670ecf30e91524dd12f7260dac07d335CVE reference, Linux
- https://git.kernel.org/stable/c/c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780CVE reference, Linux
- https://www.zerodayinitiative.com/advisories/ZDI-25-310/CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.