CVE-2025-40099

A flaw was found in the Linux kernel's CIFS/SMB client implementation. In parse_dfs_referrals(), insufficient validation of server responses to FSCTL_DFS_GET_REFERRALS requests allows a malicious SMB server to send crafted replies that cause out-of-bounds memory access. Specifically, replies smaller than expected or with mismatched referral counts can trigger the vulnerability. A system connecting to a malicious or compromised SMB server could experience a kernel crash or memory corruption.

This vulnerability requires connecting to a malicious SMB server. While the attack vector is network-adjacent (requires SMB mount), exploitation depends on the attacker controlling the server. The impact is denial of service through kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the cifs module from being loaded if SMB/CIFS filesystem access is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.