Security readout for executives and security teams
Plain-English summary
Linux’s ksmbd SMB server lacks a bounds check when handling a create lease context. A network user with limited privileges could potentially expose sensitive kernel memory or disrupt the server. Integrity impact is not indicated. Systems that do not use ksmbd have low direct exposure.
Executive priority
Expedite assessment and patching for SMB servers using ksmbd, particularly network-reachable systems. Potential confidentiality and availability impacts are substantial. The issue is high rather than critical because limited privileges are required and active exploitation is not established. Deprioritize non-ksmbd hosts only after confirming they are not exposed.
Technical view
CVE-2025-22042 affects ksmbd create lease context handling. The CVSS 8.1 vector indicates network access, low complexity, low privileges, no user interaction, high confidentiality impact, and high availability impact. The kernel fix adds the missing bounds check. The supplied sources do not describe the precise memory-access primitive.
Likely exposure
Exposure requires a Linux system running ksmbd and accepting reachable SMB requests. The bundle marks several 5.15-to-6.15-era kernel entries as affected, but does not provide clear range semantics. Distribution package versions and backports must therefore be checked against vendor guidance and the linked stable fixes.
Exploitation context
The bundle reports that this CVE is not in KEV and provides no evidence of active exploitation or a public proof of concept. CVSS indicates network reachability and low attack complexity, but also requires low privileges. These are scoring assumptions, not confirmation that reliable exploitation exists.
Researcher notes
The bundle provides minimal root-cause detail and several stable-kernel commits. It does not establish exact malformed-field mechanics, crash signatures, exploitation primitives, or unambiguous affected and fixed ranges. The version data includes an unexplained "0" and repeated commit identifiers, so branch status should be confirmed through patch ancestry and distribution advisories.
Mitigation direction
- Install a distribution kernel update that incorporates the relevant linked Linux stable fix.
- Reboot into the updated kernel and confirm the fixed kernel is running.
- Check Linux and distribution advisories for exact fixed package versions and backport status.
- Until updated, restrict SMB access to trusted networks and least-privileged accounts.
- Disable ksmbd temporarily if it is unnecessary and operational policy permits.
Validation and detection
- Inventory systems to determine whether ksmbd is installed, loaded, configured, and serving SMB traffic.
- Compare each running kernel package and vendor backport status with the referenced stable fixes.
- Confirm SMB access is not exposed beyond intended network and account trust boundaries.
- After updating, verify the corrected kernel is running and normal ksmbd operations remain functional.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22042 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H2.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/629dd37acc336ad778979361c351e782053ea284CVE reference, Linux
- https://git.kernel.org/stable/c/60b7207893a8a06c78441934931a08fdad63f18eCVE reference, Linux
- https://git.kernel.org/stable/c/800c482c9ef5910f05e3a713943c67cc6c1d4939CVE reference, Linux
- https://git.kernel.org/stable/c/a41cd52f00907a040ca22c73d4805bb79b0d0972CVE reference, Linux
- https://git.kernel.org/stable/c/9a1b6ea955e6c7b29939a6d98701202f9d9644ecCVE reference, Linux
- https://git.kernel.org/stable/c/bab703ed8472aa9d109c5f8c1863921533363daeCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.