CVE-2025-21994

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21994
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix incorrect validation for num_aces field of smb_acl parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an incorrect validation that we can create an array of size ULONG_MAX. smb_acl has ->size field to calculate actual number of aces in request buffer size. Use this to check invalid num_aces.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1b8b67f3c5e5169535e26efedd3e422172e2db64 Patch
https://git.kernel.org/stable/c/9c4e202abff45f8eac17989e549fc7a75095f675 Patch
https://git.kernel.org/stable/c/a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd Patch
https://git.kernel.org/stable/c/c3a3484d9d31b27a3db0fab91fcf191132d65236 Patch
https://git.kernel.org/stable/c/d0f87370622a853b57e851f7d5a5452b72300f19 Patch
https://git.kernel.org/stable/c/f6a6721802ac2f12f4c1bbe839a4c229b61866f2 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
History

28 Oct 2025, 17:19

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/1b8b67f3c5e5169535e26efedd3e422172e2db64 - () https://git.kernel.org/stable/c/1b8b67f3c5e5169535e26efedd3e422172e2db64 - Patch
References () https://git.kernel.org/stable/c/9c4e202abff45f8eac17989e549fc7a75095f675 - () https://git.kernel.org/stable/c/9c4e202abff45f8eac17989e549fc7a75095f675 - Patch
References () https://git.kernel.org/stable/c/a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd - () https://git.kernel.org/stable/c/a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd - Patch
References () https://git.kernel.org/stable/c/c3a3484d9d31b27a3db0fab91fcf191132d65236 - () https://git.kernel.org/stable/c/c3a3484d9d31b27a3db0fab91fcf191132d65236 - Patch
References () https://git.kernel.org/stable/c/d0f87370622a853b57e851f7d5a5452b72300f19 - () https://git.kernel.org/stable/c/d0f87370622a853b57e851f7d5a5452b72300f19 - Patch
References () https://git.kernel.org/stable/c/f6a6721802ac2f12f4c1bbe839a4c229b61866f2 - () https://git.kernel.org/stable/c/f6a6721802ac2f12f4c1bbe839a4c229b61866f2 - Patch

10 Apr 2025, 13:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: Se corrige la validación incorrecta del campo num_aces de smb_acl. La función parse_dcal() valida num_aces para asignar posix_ace_state_array. Si (num_aces > ULONG_MAX / sizeof(struct smb_ace *)), se considera una validación incorrecta que permita crear una matriz de tamaño ULONG_MAX. smb_acl tiene el campo ->size para calcular el número real de ases en el tamaño del búfer de solicitud. Úselo para comprobar num_aces no válidos.
References
  • () https://git.kernel.org/stable/c/c3a3484d9d31b27a3db0fab91fcf191132d65236 -

02 Apr 2025, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-02 14:16

Updated : 2025-10-28 17:19

NVD link : CVE-2025-21994

Mitre link : CVE-2025-21994

CVE.ORG link : CVE-2025-21994

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo