{"id":"CVE-2025-22037","published":"2025-04-16T14:11:55Z","modified":"2026-10-30T12:21:08Z","title":"ksmbd: fix null pointer dereference in alloc_preauth_hash()","vendor":"Linux","product":"Linux","tier":"core","eol":null,"affectedVersions":[{"vendor":"Linux","product":"Linux","versions":[">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 2d3461d6ae74ebdcd4d65128c855198649bcadcd",">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < cce57cd8c5dead24127cf2308fdd60fcad2d6ba6",">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < ca8bed31edf728a662ef9d6f39f50e7a7dc2b5ad",">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < 8f216b33a5e1b3489c073b1ea1b3d7cb63c8dc4d",">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < b8eb243e670ecf30e91524dd12f7260dac07d335",">= 0626e6641f6b467447c81dd7678a69c66f7746cf, < c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780"]},{"vendor":"Linux","product":"Linux","versions":["5.15"]}],"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix null pointer dereference in alloc_preauth_hash()\n\nThe Client send malformed smb2 negotiate request. ksmbd return error\nresponse. Subsequently, the client can send smb2 session setup even\nthought conn->preauth_info is not allocated.\nThis patch add KSMBD_SESS_NEED_SETUP status of connection to ignore\nsession setup request if smb2 negotiate phase is not complete.","provenance":"source","from":"CVE.org"},"summary":{"text":"The ksmbd in-kernel SMB server component of the Linux kernel contains a null pointer dereference in alloc_preauth_hash(), which is reached when a client sends a malformed SMB2 negotiate request and then proceeds to a session setup request before preauth state has been allocated. A remote, unauthenticated attacker with network access to the SMB service can trigger this condition without user interaction or special configuration, causing a denial of service (availability impact).","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:33Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.6951,"percentile":0.99361,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://git.kernel.org/stable/c/2d3461d6ae74ebdcd4d65128c855198649bcadcd","tags":[]},{"url":"https://git.kernel.org/stable/c/cce57cd8c5dead24127cf2308fdd60fcad2d6ba6","tags":[]},{"url":"https://git.kernel.org/stable/c/ca8bed31edf728a662ef9d6f39f50e7a7dc2b5ad","tags":[]},{"url":"https://git.kernel.org/stable/c/8f216b33a5e1b3489c073b1ea1b3d7cb63c8dc4d","tags":[]},{"url":"https://git.kernel.org/stable/c/b8eb243e670ecf30e91524dd12f7260dac07d335","tags":[]},{"url":"https://git.kernel.org/stable/c/c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780","tags":[]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-310/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-11252","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-11252","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-04-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-22037","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9936"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}