CVE-2025-39975

CVE-2025-39975

Critical · published October 15, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix wrong index reference in smb2_compound_op()

In smb2_compound_op(), the loop that processes each command's response

uses wrong indices when accessing response bufferes.

This incorrect indexing leads to improper handling of command results.

Also, if incorrectly computed index is greather than or equal to

MAX_COMPOUND, it can cause out-of-bounds accesses.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00467 · 39.5th percentile
Published
2025-10-15T12:15Z
References (4)
EPSS history
Timeline
  • 15 OCT 07:55Z
    smb: client: fix wrong index reference in smb2_compound_op()
    cvelistv5