Kernel Oops Prevention in Linux: ksmbd Rename Vulnerability
Summary
CVE-2025-37956: In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent rename with empty string Client can send empty newname string to ksmbd server. Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's ksmbd module facilitates SMB (Server Message Block) protocol support, allowing file sharing and printing services over a network. However, a recent vulnerability has been identified in the ksmbd module, which could lead to system instability when an empty string is used as a new name during file or directory renaming operations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been discovered in the ksmbd module that allows a client to send an empty string as a new name when renaming a file or directory. This action triggers a kernel oops due to an invalid operation in the d_alloc function. The consequence of this vulnerability can lead to system crashes or unexpected behavior, making it critical to address. The issue arises from insufficient validation of input parameters, which can be exploited by malicious users to disrupt system operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid renaming files or directories with an empty string as the new name. Implementing input validation in applications that interact with the ksmbd module can also help mitigate the risk until the kernel is updated.
Conclusion
The CVE-2025-37956 vulnerability in the Linux kernel's ksmbd module poses a significant risk by allowing empty string renaming, leading to kernel oops and potential system instability. Users should promptly update their kernel to the patched version and implement workarounds to mitigate risks until the update is applied.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37956 is a vulnerability in the Linux kernel's ksmbd module that allows clients to send an empty string as a new name during renaming operations, leading to a kernel oops.
This vulnerability can cause system crashes or instability when an empty string is used for renaming files or directories, potentially disrupting services that rely on the ksmbd module.
Yes, a patch has been released for the Linux kernel that addresses this vulnerability. Users are encouraged to update their systems to the latest kernel version.
If you cannot update your kernel right away, avoid renaming files or directories with an empty string as the new name and implement input validation in your applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to access the code.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
