CVE-2025-39975
published 2025-10-15CVE-2025-39975: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the…
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.47%
40.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix wrong index reference in smb2_compound_op()
In smb2_compound_op(), the loop that processes each command's response
uses wrong indices when accessing response bufferes.
This incorrect indexing leads to improper handling of command results.
Also, if incorrectly computed index is greather than or equal to
MAX_COMPOUND, it can cause out-of-bounds accesses.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.16.10-1 (forky) | linux 6.16.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3681c74d342db75b0d641ba60de27bf73e16e66b < 093615fc76063ea08d454ba86677ce64c736e806 | 093615fc76063ea08d454ba86677ce64c736e806 |
| linux | linux | >= 3681c74d342db75b0d641ba60de27bf73e16e66b < fbe2dc6a9c7318f7263f5e4d50f6272b931c5756 | fbe2dc6a9c7318f7263f5e4d50f6272b931c5756 |
| linux | linux | >= 5ddcc9e92d54548219985ce4de88618fb53e14ec < ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5 | ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5 |
| linux | linux | >= 6.12.12 < 6.12.50 | 6.12.50 |
| linux | linux | >= 6.13.1 < 6.14 | 6.14 |
| linux | linux | >= 6.6.75 < 6.6.109 | 6.6.109 |
| linux | linux | >= efe8db3ecaa40a8520dc9a54283dcecd82ceea9c < bfb1e2aad1fecef8320fd71332acde0d53a8d699 | bfb1e2aad1fecef8320fd71332acde0d53a8d699 |
| linux | linux_kernel | >= 0 < 6.12.57-1 | 6.12.57-1 |
| linux | linux_kernel | >= 0 < 6.16.10-1 | 6.16.10-1 |
| linux | linux_kernel | >= 0 < 6.6.109 | 6.6.109 |
| linux | linux_kernel | >= 6.13.0 < 6.16.10 | 6.16.10 |
| linux | linux_kernel | >= 6.7.0 < 6.12.50 | 6.12.50 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: smb: client: fix wrong index reference in smb2_compound_op()
vendor_redhat·2025-10-15·CVSS 5.8
CVE-2025-39975 [MEDIUM] CWE-1285 kernel: smb: client: fix wrong index reference in smb2_compound_op()
kernel: smb: client: fix wrong index reference in smb2_compound_op()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix wrong index reference in smb2_compound_op()
In smb2_compound_op(), the loop that processes each command's response
uses wrong indices when accessing response bufferes.
This incorrect indexing leads to improper handling of command results.
Also, if incorrectly computed index is greather than or equal to
MAX_COMPOUND, it can cause out-of-bounds accesses.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux
Debian
CVE-2025-39975: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client...
vendor_debian·2025
CVE-2025-39975 [LOW] CVE-2025-39975: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client...
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes. This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index is greather than or equal to MAX_COMPOUND, it can cause out-of-bounds accesses.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.16.10-1)
sid: resolved (fixed in 6.16.10-1)
trixie: resolved (fixed in 6.12.57-1)
GHSA
GHSA-cm9p-f4x4-35gj: In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix wrong index reference in smb2_compound_op()
In smb2_compound_op
ghsa_unreviewed·2025-10-15
CVE-2025-39975 GHSA-cm9p-f4x4-35gj: In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix wrong index reference in smb2_compound_op()
In smb2_compound_op
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix wrong index reference in smb2_compound_op()
In smb2_compound_op(), the loop that processes each command's response
uses wrong indices when accessing response bufferes.
This incorrect indexing leads to improper handling of command results.
Also, if incorrectly computed index is greather than or equal to
MAX_COMPOUND, it can cause out-of-bounds accesses.
OSV
smb: client: fix wrong index reference in smb2_compound_op()
osv·2025-10-15
CVE-2025-39975 smb: client: fix wrong index reference in smb2_compound_op()
smb: client: fix wrong index reference in smb2_compound_op()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix wrong index reference in smb2_compound_op()
In smb2_compound_op(), the loop that processes each command's response
uses wrong indices when accessing response bufferes.
This incorrect indexing leads to improper handling of command results.
Also, if incorrectly computed index is greather than or equal to
MAX_COMPOUND, it can cause out-of-bounds accesses.
OSV
CVE-2025-39975: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op()
osv·2025-10-15
CVE-2025-39975 CVE-2025-39975: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes. This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index is greather than or equal to MAX_COMPOUND, it can cause out-of-bounds accesses.
No detection rules found.
No public exploits indexed.
2025-10-15
Published