Security readout for executives and security teams
Plain-English summary
A network client with limited privileges can send an invalid rename request to Linux’s ksmbd SMB server and trigger a kernel crash. Systems are at risk when ksmbd is enabled and reachable. The supplied evidence describes a crash condition; it does not demonstrate data theft, modification, or active exploitation.
Executive priority
Prioritize exposed or business-critical ksmbd servers because an authorized network client may crash the kernel without user interaction. Patch promptly through supported distribution channels. Treat systems without ksmbd, or with tightly restricted SMB reachability, as lower immediate priority after confirming configuration.
Technical view
ksmbd accepted a rename request containing an empty destination name. That value could reach d_alloc and cause a kernel oops. The kernel fix rejects empty new-name strings. CVSS 3.1 rates this 8.8 with network reachability, low complexity, low privileges, and no user interaction.
Likely exposure
Exposure is most likely on Linux systems running ksmbd and accepting SMB connections from untrusted or broadly authorized clients. The supplied version data identifies affected Linux releases but is ambiguous about exact ranges; validate distribution kernels by vendor advisory and included fix commit.
Exploitation context
The CVSS vector indicates remote, low-complexity exploitation requiring low privileges. No user interaction is required. The supplied record is not in CISA KEV, and no cited source establishes active exploitation. Practical impact supported by the description is a kernel oops and resulting service or system disruption.
Researcher notes
The record supplies four stable-kernel fix commits and describes input validation before d_alloc. It lists no CWE. Exact affected-version boundaries are not clearly represented in the supplied bundle, so commit ancestry or distribution package advisories should drive validation. Do not infer confidentiality or integrity compromise solely from the CVSS impact metrics.
Mitigation direction
- Install a vendor-supported kernel containing the ksmbd empty-rename fix.
- Check distribution guidance to map patched package versions accurately.
- Disable ksmbd where SMB service is not operationally required.
- Restrict SMB access to trusted networks and necessary authenticated users.
Validation and detection
- Confirm whether ksmbd is enabled on each Linux host.
- Identify whether SMB is reachable from untrusted or unnecessary network segments.
- Compare the running kernel package with current distribution security guidance.
- Verify the installed kernel includes a referenced stable fix commit.
- After updating, confirm hosts booted into the patched kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37956 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6ee551672c8cf36108b0cfba92ec0c7c28ac3439CVE reference, Linux
- https://git.kernel.org/stable/c/c57301e332cc413fe0a7294a90725f4e21e9549dCVE reference, Linux
- https://git.kernel.org/stable/c/d7f2c00acb1ef64304fd40ac507e9213ff1d9b5cCVE reference, Linux
- https://git.kernel.org/stable/c/53e3e5babc0963a92d856a5ec0ce92c59f54bc12CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.