Security readout for executives and security teams
Plain-English summary
A remotely reachable flaw in Linux’s ksmbd SMB Direct handling can allow an unauthenticated attacker to disrupt an affected system. The supplied CVSS assessment rates availability impact as high, with no stated confidentiality or integrity impact. Business risk is greatest where affected Linux hosts provide reachable ksmbd-based file-sharing services.
Executive priority
Prioritize affected, network-reachable file servers because exploitation requires neither credentials nor user interaction and could cause significant service disruption. Patch exposed production systems promptly through supported distribution channels. Lower the priority only after confirming ksmbd SMB Direct is absent, unreachable, or the vendor kernel already includes the fix.
Technical view
ksmbd’s SMB Direct receive path did not verify that remaining_data_length stayed within max_fragmented_recv_size. The supplied record describes the issue as resolved by adding validation analogous to the existing data_offset plus data_length check. CVSS 3.1 is 7.5: network-accessible, low complexity, no privileges or interaction, with high availability impact.
Likely exposure
Potential exposure is limited to systems running affected Linux kernel versions where ksmbd’s SMB Direct functionality is present and reachable over a network. The supplied affected-version data includes 5.15, 6.1.154, 6.6.108, 6.12.49, 6.16.9, and 6.17, but distribution backports may change actual status.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. The CVSS vector indicates remote, unauthenticated, low-complexity attack potential, but the source bundle does not document attack prevalence, reliable exploitation, or the precise failure mode.
Researcher notes
The source bundle supplies no CWE, proof of concept, crash trace, or detailed malformed-message behavior. Five stable-kernel fix commits are referenced. Version metadata contains duplicated commit hashes and broad entries, so researchers should use commit ancestry and distribution backport records rather than version-string matching alone.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix or confirmed backport.
- Check distribution security guidance before relying solely on upstream version numbers.
- Restrict network access to affected file-sharing services while updates are pending.
- Review vendor guidance for safe temporary mitigation if immediate patching is impossible.
Validation and detection
- Record the running kernel and compare it with distribution security advisories.
- Confirm whether ksmbd and SMB Direct functionality are deployed and network-reachable.
- Verify the installed kernel contains the applicable upstream fix or vendor backport.
- Retest service availability and normal SMB operations after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39942 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/196a3a7676d726ee67621ea2bf3b7815ac2685b4CVE reference, Linux
- https://git.kernel.org/stable/c/d3cb3f209d35c44b7ee74f77ed27ebb28995b9ceCVE reference, Linux
- https://git.kernel.org/stable/c/9644798294c7287e65a7b26e35aa6d2ce3345bccCVE reference, Linux
- https://git.kernel.org/stable/c/c64b915bb3d9339adcae5db4be2c35ffbef5e615CVE reference, Linux
- https://git.kernel.org/stable/c/e1868ba37fd27c6a68e31565402b154beaa65df0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.