NetSight
IP …
high8.8

CVE-2025-37947

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating *pos ksmbd_vfs_stream_write() did …

Impact

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating *pos ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data length (v_len). If *pos was greater than or equal to v_len, this could lead to an out-of-bounds memory write. This patch adds a check to ensure *pos is less than v_len before proceeding. If the condition fails, -EINVAL is returned.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.15 before 6.1.139
from 6.2 before 6.6.91
from 6.7 before 6.12.29
from 6.13 before 6.14.7
Version 6.15
DebianDebian Linux
Version 11.0

Weakness classification

CWE-787

References