Out-of-Bounds Vulnerability in Linux Kernel - Package: linux
Summary
DEBIAN-CVE-2025-21946: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parse_sec_desc() If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd struct size. Affects linux versions < 6.12.19-1. Fixed in 6.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing system resources and hardware interactions. It provides essential services for all other software running on the system. The kernel is known for its stability, performance, and security features, but like any complex software, it can have vulnerabilities. This specific vulnerability affects the ksmbd module, which is responsible for SMB (Server Message Block) file sharing.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ksmbd module, specifically in the parse_sec_desc() function. This issue arises when the offsets osidoffset, gsidoffset, and dacloffset exceed the size of the smb_ntsd struct. If these offsets are smaller than expected, it can lead to a slab-out-of-bounds condition, potentially allowing an attacker to exploit this flaw. The vulnerability requires careful validation of the Security Identifier (SID) and its subauth array size to prevent unauthorized access or system instability.
How To Fix
Minimum fixed version
6.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The out-of-bounds vulnerability in the Linux kernel's ksmbd module poses a significant risk to system security. It is crucial for users to update their linux package to the patched version 6.12.19-1 to mitigate this risk. Regular monitoring and updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds issue in the ksmbd module of the Linux kernel, which can lead to potential exploitation if not addressed.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By uploading your manifest file, you can check if your application is affected by this vulnerability.
If exploited, this vulnerability could allow unauthorized access to system resources, potentially leading to data breaches or system crashes.
Yes, a patch has been released in version 6.12.19-1 of the linux package. It is recommended to update to this version.
You can use Vulert to monitor your applications for vulnerabilities in real-time without needing to access the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
