Kernel Vulnerability in Linux Package: Overflow in DACL Bounds Check
Summary
DEBIAN-CVE-2025-22039: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. The kernel is crucial for system stability and security. The vulnerability identified as DEBIAN-CVE-2025-22039 affects the Linux package in Debian versions 13 and 14, specifically in the ksmbd component responsible for SMB (Server Message Block) file sharing. This vulnerability could lead to serious security risks if left unaddressed.
Vulnerability Detail
The vulnerability arises from an overflow in the dacloffset bounds check within the ksmbd component of the Linux kernel. The dacloffset field was originally defined as an integer and was used in an unchecked addition operation. This could lead to an overflow, allowing an attacker to bypass existing bounds checks in the functions smb_check_perm_dacl() and smb_inherit_dacl(). The consequence of this vulnerability is out-of-bounds memory access, which can result in a kernel crash when the DACL pointer is dereferenced, potentially leading to system instability and security breaches.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
The vulnerability DEBIAN-CVE-2025-22039 in the Linux kernel poses significant risks due to an overflow in the DACL bounds check. It is crucial to update to the patched version 6.12.25-1 to ensure system security and stability. Regular monitoring using tools like Vulert can help maintain awareness of such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
DEBIAN-CVE-2025-22039 is a vulnerability in the Linux kernel that affects the ksmbd component, leading to potential out-of-bounds memory access and kernel crashes.
If exploited, this vulnerability could lead to system instability, crashes, and potential unauthorized access to system resources.
Debian versions 13 and 14 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
Currently, there are no known workarounds. The recommended action is to update to the patched version of the Linux package.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
