Security readout for executives and security teams
Plain-English summary
A Linux SMB client flaw can write beyond an allocated kernel buffer while processing SMB Direct/RDMA writes. The supplied test evidence shows memory corruption detected by KASAN. A successful trigger could crash or compromise the affected host, but the sources do not demonstrate real-world exploitation.
Executive priority
Treat as a high-priority kernel maintenance issue on exposed SMB Direct/RDMA clients, especially shared or multi-user hosts. Patch through supported vendor channels after compatibility testing. Systems not using the affected CIFS/RDMA path appear less exposed, but the available evidence is insufficient to declare them unaffected solely from configuration.
Technical view
An overflow in smb_extract_folioq_to_rdma() can exceed the maximum scatter-gather entry count, causing a slab out-of-bounds write in smb_set_sge(). The supplied CVSS 3.1 score is 7.8 with local access and low privileges required. The observed path involves the CIFS client and SMB Direct/RDMA send processing.
Likely exposure
Prioritize Linux systems running affected kernels that use the CIFS/SMB client with SMB Direct/RDMA and permit low-privileged users or processes to generate SMB writes. The bundle lists 6.12, 6.12.35, 6.15.4, and 6.16 as affected, but its unexplained “0” entry should be verified.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. Testing reproduced a KASAN-detected out-of-bounds kernel write during CIFS write activity. The CVSS vector indicates a local, low-privileged attack path without user interaction; remote exploitability is not established.
Researcher notes
The demonstrated condition is an eight-byte slab out-of-bounds write in smb_set_sge(), reached through smbd_post_send_iter() during CIFS writes. The title attributes the root cause to max_sge overflow in smb_extract_folioq_to_rdma(). The bundle does not identify a CWE, proven security impact beyond memory corruption, exploit primitive, or precise fixed release mapping.
Mitigation direction
- Apply a vendor kernel update containing the cited stable-kernel correction.
- Confirm fixed package versions with the relevant Linux distribution advisory.
- Where operationally acceptable, avoid SMB Direct/RDMA until affected systems are patched.
- Prioritize multi-user systems where untrusted local processes can write to SMB shares.
Validation and detection
- Inventory kernel versions and compare them with current distribution advisories.
- Identify hosts loading the CIFS client and using SMB Direct/RDMA.
- Confirm the installed kernel includes the applicable cited fix commit or vendor backport.
- Review kernel logs for CIFS crashes, KASAN reports, or unexplained memory-corruption events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38179 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8ae7814589d7bd850294ac14ec4c1725dafd42caCVE reference, Linux
- https://git.kernel.org/stable/c/e0ba9b2f188166550296005e64b15e80db82ad8aCVE reference, Linux
- https://git.kernel.org/stable/c/a379a8a2a0032e12e7ef397197c9c2ad011588d6CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.