CVE-2025-39975

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix wrong index reference in smb2_compound_op()

In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes.

This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index is greather than or equal to MAX_COMPOUND, it can cause out-of-bounds accesses.

This vulnerability is rated as Moderate severity because exploitation requires an active SMB client connection processing compound responses, limiting exposure to systems configured to mount remote CIFS shares. In standard Red Hat Enterprise Linux installations, the kernel SMB client module is loaded on demand when mounting network shares and is not active by default. Exploitation depends on interacting with a malicious or compromised SMB server, where malformed compound responses can cause kernel memory corruption or a denial-of-service crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.