Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s ksmbd SMB Direct handling can allow unauthenticated network data with invalid offsets or lengths to cause out-of-bounds access. The supplied CVSS score is 9.4, indicating potentially serious confidentiality, integrity, and availability consequences. Exposure depends on whether ksmbd with SMB Direct is enabled and reachable.
Executive priority
Prioritize immediate assessment of internet-facing or broadly reachable Linux file servers using ksmbd and SMB Direct. Patch confirmed exposures urgently and restrict network access while remediation proceeds. Lower the priority only after verifying the vulnerable feature path is disabled, unreachable, or corrected by the running vendor kernel.
Technical view
The ksmbd smbdirect recv_done path did not adequately validate data_offset and data_length in smb_direct_data_transfer. Invalid values could produce an out-of-bounds condition. The kernel fix adds bounds validation. The supplied CVSS vector indicates network access, low complexity, no privileges, and no user interaction, but the bundle does not describe the precise memory-corruption outcome.
Likely exposure
Highest risk applies to systems running affected Linux kernels where ksmbd and SMB Direct are enabled and reachable from untrusted networks. Systems not using ksmbd or SMB Direct are less likely to expose the vulnerable path. The supplied version data is ambiguous, so distribution-specific package status should determine applicability.
Exploitation context
The bundle reports no CISA KEV listing and provides no evidence of active exploitation or a public exploit. The CVSS assessment nevertheless describes an unauthenticated, low-complexity network attack path. Treat exploitability as plausible but unconfirmed until vendor or threat-intelligence sources provide stronger evidence.
Researcher notes
The evidence establishes a missing bounds check and multiple stable-kernel fix commits. It does not identify a CWE, crash signature, affected distribution packages, public proof of concept, or observed attacks. The affected-version list includes unclear entries and should not be treated as authoritative package-range guidance without consulting the relevant Linux distribution.
Mitigation direction
- Install a vendor-supported kernel containing the referenced bounds-validation fix.
- Check distribution security advisories for exact fixed package versions.
- Disable ksmbd or SMB Direct where operationally unnecessary.
- Restrict SMB and RDMA access to trusted networks until patched.
- Reboot into the updated kernel and confirm the running version.
Validation and detection
- Inventory systems running Linux with ksmbd enabled.
- Determine whether SMB Direct or RDMA support is active.
- Verify SMB-related services are not exposed to untrusted networks.
- Compare running kernel packages against distribution advisories.
- Confirm the applicable stable-kernel fix is present after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39943 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H3.95.5LinuxVulnerability scoring details
Base CVSS 3.1 score
9.4CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/773fddf976d282ef059c36c575ddb81567acd6bcCVE reference, Linux
- https://git.kernel.org/stable/c/bdaab5c6538e250a9654127e688ecbbeb6f771d5CVE reference, Linux
- https://git.kernel.org/stable/c/eb0378dde086363046ed3d7db7f126fc3f76fd70CVE reference, Linux
- https://git.kernel.org/stable/c/8be498fcbd5b07272f560b45981d4b9e5a2ad885CVE reference, Linux
- https://git.kernel.org/stable/c/529b121b00a6ee3c88fb3c01b443b2b81f686d48CVE reference, Linux
- https://git.kernel.org/stable/c/5282491fc49d5614ac6ddcd012e5743eecb6a67cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.