Security readout for executives and security teams
Plain-English summary
A flaw in Linux's ksmbd SMB server can read beyond intended memory when processing a security identifier with zero sub-authorities. An authenticated network user could potentially expose data, cause limited modification, or disrupt service. Systems not using ksmbd are less likely to be exposed.
Executive priority
Treat as a high-priority kernel update for reachable ksmbd servers, especially where many authenticated users can connect. Prioritize exposure discovery immediately, then patch according to distribution guidance. Hosts without ksmbd use are lower priority after configuration is verified.
Technical view
When num_subauth is zero, ksmbd accesses sub_auth[num_subauth - 1], producing an out-of-bounds read. The correction validates that num_subauth is nonzero before access. CVSS 3.1 rates it 8.3: network-accessible, low complexity, low privileges, no user interaction, with high confidentiality and availability impact.
Likely exposure
Highest exposure is on affected Linux systems running ksmbd with SMB reachable by untrusted or broadly authorized clients. Exploitation requires low privileges. The supplied version data is ambiguous, so determine exposure through distribution advisories and whether the installed kernel contains the applicable stable fix.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. That absence does not prove exploitation is impossible. The network attack vector, low complexity, and low privilege requirement make exposed ksmbd servers important to remediate.
Researcher notes
CWE-125 applies. The fault is an index underflow leading to an out-of-bounds read when num_subauth equals zero. Stable-tree corrections are referenced for multiple branches. The supplied affected-version array is not sufficiently clear for precise package decisions; use commit containment and distribution package advisories.
Mitigation direction
- Install a distribution-supported kernel update containing the applicable referenced stable fix.
- Follow the Linux distribution's advisory for package-specific fixed versions and reboot requirements.
- Until updated, restrict ksmbd SMB reachability to necessary, trusted clients.
- Prioritize hosts exposing ksmbd across internet-facing or broadly accessible networks.
Validation and detection
- Inventory running kernel versions and identify systems configured to use ksmbd.
- Confirm whether SMB backed by ksmbd is reachable from untrusted network segments.
- Map installed kernels to distribution advisories or the referenced stable commits.
- After updating, verify the host booted into the corrected kernel.
- Reassess network exposure and confirm vulnerability findings no longer reproduce.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22038 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H2.85.5LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.3HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3ac65de111c686c95316ade660f8ba7aea3cd3ccCVE reference, Linux
- https://git.kernel.org/stable/c/0e36a3e080d6d8bd7a34e089345d043da4ac8283CVE reference, Linux
- https://git.kernel.org/stable/c/56de7778a48560278c334077ace7b9ac4bfb2fd1CVE reference, Linux
- https://git.kernel.org/stable/c/68c6c3142bfcdb049839d40a9a59ebe8ea865002CVE reference, Linux
- https://git.kernel.org/stable/c/c8bfe1954a0b89e7b29b3a3e7f4c5e0ebd295e20CVE reference, Linux
- https://git.kernel.org/stable/c/bf21e29d78cd2c2371023953d9c82dfef82ebb36CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.