Type Confusion Vulnerability in Linux Kernel's ksmbd Package
Summary
CVE-2025-21947: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_all... Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and managing hardware resources. The ksmbd module allows for SMB (Server Message Block) protocol support, enabling file sharing and printing services over a network. This module is critical for interoperability between Linux and Windows systems. However, it is susceptible to vulnerabilities that can lead to memory access issues and potential system compromise.
Vulnerability Detail
In the Linux kernel, a type confusion vulnerability has been identified in the ksmbd module. This issue arises from a race condition during the handling of IPC (Inter-Process Communication) messages. Specifically, the req->handle is allocated using ksmbd_acquire_id(&ipc_ida), which can lead to a scenario where req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be the same. This overlap can cause type confusion between messages, resulting in access to unintended memory areas after incorrect message delivery. Although ksmbd performs type checks on IPC responses, it fails to adequately handle subsequent responses, exacerbating the issue.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. It is advisable to monitor the system for any unusual behavior and apply the patch as soon as it becomes available.
Conclusion
The type confusion vulnerability in the ksmbd module of the Linux kernel poses significant risks, including potential unauthorized access to memory. It is essential to apply the recommended updates to mitigate these risks and ensure system integrity. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a type confusion issue in the ksmbd module of the Linux kernel, which can lead to unintended memory access.
Exploitation of this vulnerability could allow an attacker to access sensitive memory areas, potentially leading to data leaks or system compromise.
Versions of the Linux kernel in Debian 11, 12, and 13 are affected, with specific fixes available for Debian 13.
While no specific workarounds are available, it is crucial to monitor your system for any unusual activity until the patch can be applied.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
