LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68786: ksmbd: skip lock-range check on equal size to avoid size==0 underflow

In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1` and can underflow for size==0. Skip the equal case.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel ksmbd flaw involving a file-lock range calculation when the target size equals the file size, including zero. The published record does not provide CVSS, impact details, or evidence of exploitation. Treat it as a kernel maintenance issue for systems using the in-kernel SMB server.

Executive priority

Track and remediate through normal kernel patch management unless ksmbd is actively used on exposed SMB servers. Escalate priority if vendor advisories later confirm meaningful impact or exploitation.

Technical view

The resolved issue skips lock-range checking when size equals current i_size. Previously, ksmbd could call check_lock_range with size - 1, creating an underflow when size is zero. Kernel stable commits are referenced, but the source bundle does not describe reachable impact, privilege requirements, or attack complexity.

Likely exposure

Likely limited to Linux systems running affected kernels with ksmbd built, loaded, or used for SMB service. Systems using Samba in user space only, or without ksmbd enabled, may not be exposed. Exact downstream package exposure needs vendor confirmation.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation, public exploit availability, or weaponized use. No exploit assumptions should be made from the record alone.

Researcher notes

The available evidence identifies a size==0 underflow avoidance fix in ksmbd lock-range handling. Missing data includes CVSS, CWE, exploitability, impact class, and precise affected/fixed release mapping. Avoid extrapolating beyond the kernel commit summary.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable ksmbd fix.
  • If ksmbd is unnecessary, disable or avoid loading the ksmbd module.
  • Restrict SMB service exposure to trusted networks where operationally possible.
  • Monitor Linux distribution advisories for exact fixed package versions.

Validation and detection

  • Inventory Linux kernel versions across SMB-serving hosts.
  • Confirm whether ksmbd is built, loaded, or configured on each host.
  • Verify installed kernels include the referenced stable fix commits or vendor backports.
  • Check distribution advisories for CVE-2025-68786 package status.
  • Prioritize internet-exposed or untrusted-network SMB servers for review.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68786 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf44158485826c076335d6860d35872271a83791d, f44158485826c076335d6860d35872271a83791d, f44158485826c076335d6860d35872271a83791d, f44158485826c076335d6860d35872271a83791d, f44158485826c076335d6860d35872271a83791dunaffected
LinuxLinux5.15, 0, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.