CVE-2025-39933

CVE-2025-39933

Critical · published October 4, 2025

CVSS v3.1
9.4
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

smb: client: let recv_done verify data_offset, data_length and remaining_data_length

This is inspired by the related server fixes.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.8th percentile
Published
2025-10-04T12:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 4.16, < 6.16.96.16.9
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (4)
https://git.kernel.org/stable/c/241e58de23e7c1bbb9bee526c17d9a0f2a90fbad · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/581fb78e0388b78911b0c920e4073737090c8b5f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f23d5c6b7540ec9b1e73a8ea3b2ae9045248d728 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f57e53ea252363234f86674db475839e5b87102e · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 04 OCT 07:30Z
    smb: client: let recv_done verify data_offset, data_length and remaining_data_length
    cvelistv5