CVE-2025-21963

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix integer overflow while processing acdirmax mount option

User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

This vulnerability is rated as Moderate because triggering the flaw requires local access with authorization to mount CIFS filesystems, limiting the blast radius to a local denial of service. While supplying an excessively large acdirmax parameter causes an arithmetic overflow during time unit conversion, it does not allow privilege escalation or remote code execution. In standard Red Hat Enterprise Linux environments, unprivileged users cannot mount network filesystems by default, significantly reducing exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.