LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input

In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of referrals smaller than NumberOfReferrals in the header Processing of such replies will cause oob. Return -EINVAL error on such replies to prevent oob-s.

CriticalCVSS 9.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A malicious SMB server can send a malformed DFS referral response that causes the Linux CIFS client to access memory outside valid bounds. This could crash or compromise a connecting Linux system. Risk is highest where servers mount SMB shares or follow DFS referrals from untrusted or compromised infrastructure.

Executive priority

Prioritize affected systems that connect to external, partner-managed, or less-trusted SMB servers. Accelerate vendor-supported kernel updates because successful triggering may affect confidentiality and availability without user interaction. Scope exposure before treating every Linux host as vulnerable.

Technical view

The Linux CIFS function parse_dfs_referrals insufficiently validated FSCTL_DFS_GET_REFERRALS responses. An undersized response or inconsistent NumberOfReferrals value can cause out-of-bounds memory access. The published correction rejects malformed replies with EINVAL. The supplied record assigns CVSS 3.1 score 9.4.

Likely exposure

Potentially exposed systems run an affected Linux kernel and use CIFS to communicate with an attacker-controlled or compromised SMB server, particularly through DFS referrals. The supplied affected-version data is ambiguous, so distribution-specific kernel advisories should determine actual exposure.

Exploitation context

The flaw is remotely triggerable by a malicious SMB server responding to a Linux CIFS client. The supplied record is not in KEV and provides no evidence of active exploitation or a public weaponized exploit.

Researcher notes

The vulnerable parser trusts malformed length and referral-count data. The fix adds structural validation before processing referrals. The source bundle does not establish the precise introduction boundary, affected distribution packages, exploitation prevalence, or whether the out-of-bounds condition reliably enables code execution.

Mitigation direction

  • Install a vendor kernel update containing the referenced Linux stable fix.
  • Confirm distribution backports rather than relying only on upstream version numbers.
  • Until patched, restrict CIFS connections and DFS referrals to trusted SMB infrastructure.
  • Review vendor guidance for any additional supported mitigations.

Validation and detection

  • Inventory Linux systems using CIFS mounts or SMB DFS referrals.
  • Record running kernel and distribution package versions on exposed systems.
  • Verify the installed kernel contains the applicable referenced stable fix or vendor backport.
  • Confirm systems rebooted into the updated kernel after installation.
  • Monitor kernel logs for CIFS faults or unexpected disconnects involving SMB servers.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40099 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.4CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H3.95.5Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.4Critical
CVSS 3.1 vector shape for CVE-2025-40099Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4ecce920e13ace16a5ba45efe8909946c28fb2ad, 4ecce920e13ace16a5ba45efe8909946c28fb2ad, 4ecce920e13ace16a5ba45efe8909946c28fb2ad, 4ecce920e13ace16a5ba45efe8909946c28fb2ad, 4ecce920e13ace16a5ba45efe8909946c28fb2adunaffected
LinuxLinux4.11, 0, 6.1.158, 6.6.114, 6.12.55, 6.17.5, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.