Critical Divide Error Vulnerability in Linux Kernel's CIFS Client
Summary
CVE-2025-21725: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to unset link speed It isn't guaranteed that NETWORK_INTERFACE_INFO::LinkSpeed will always be set by the server, so the client... Affects linux versions < 6.1.129-1. Fixed in 6.1.129-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and managing hardware resources. It includes various subsystems, one of which is the Common Internet File System (CIFS) client, enabling file sharing over a network. This vulnerability affects the CIFS client, which may not handle unset link speed values properly, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, specifically within the CIFS client, there exists a vulnerability where the NETWORK_INTERFACE_INFO::LinkSpeed may not always be set by the server. This oversight can lead to a divide error when the client attempts to process unset values, resulting in a system crash (oops). The error can manifest in various ways, including kernel panic, which can disrupt services and compromise system stability.
How To Fix
Minimum fixed version
6.1.129-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set the cifs_server_iface::speed to a default value of 1Gbps in your configuration to prevent the divide error from occurring. This can be done by modifying the relevant configuration files or through system settings, depending on your environment.
Conclusion
The CVE-2025-21725 vulnerability in the Linux kernel's CIFS client poses a significant risk of system crashes due to unset link speed values. It is crucial to update your system to the latest patched version to ensure stability and security. For those unable to update immediately, applying the recommended workaround can help mitigate potential issues.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21725 is a vulnerability in the Linux kernel's CIFS client that can lead to a divide error and system crash due to unset link speed values.
If your system uses the CIFS client and encounters unset link speed values, it may experience crashes or instability, affecting services reliant on file sharing.
Yes, a patch has been released for the Linux kernel to address this vulnerability. Updating to the latest version will resolve the issue.
Yes, you can use Vulert, which monitors open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If immediate updates are not possible, consider applying the workaround by setting the cifs_server_iface::speed to a default value of 1Gbps to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
