CVE-2025-39933

In the Linux kernel, the following vulnerability has been resolved:

smb: client: let recv_done verify data_offset, data_length and remaining_data_length

This is inspired by the related server fixes.

SMB Direct client failed to validate data_offset, data_length, and remaining_data_length in SMBD “data transfer” messages. A malicious server can craft values that cause out-of-bounds access in the kernel receive path, leading to memory corruption and potential code execution. A malicious SMB Direct server can trigger a kernel crash on a connected and authenticated Linux client by sending malformed data transfer packets over an active RDMA session.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.