Kernel Vulnerability in Linux Package: Preventing Rename with Empty String
Summary
DEBIAN-CVE-2025-37956: In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent rename with empty string Client can send empty newname string to ksmbd server. Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including memory management, process scheduling, and device control. The kernel is crucial for system stability and performance. This vulnerability specifically affects the ksmbd server, which is responsible for handling SMB (Server Message Block) protocol requests, allowing file and printer sharing between computers. The vulnerability arises from improper handling of rename operations when an empty string is provided as a new name.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ksmbd server that allows clients to send an empty string as a new name during a rename operation. This can lead to a kernel oops, which is a serious error that can crash the kernel or lead to undefined behavior. The issue originates from the failure to validate the new name string before processing the rename request, resulting in a call to d_alloc with an empty string. If exploited, this vulnerability could disrupt file operations and potentially lead to system instability.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, it is advisable to avoid sending empty strings as new names during rename operations to prevent triggering the vulnerability until the system can be updated.
Conclusion
The vulnerability in the Linux kernel related to the ksmbd server poses a significant risk by allowing clients to rename files with an empty string, leading to potential system crashes. Users are encouraged to update their systems to the patched version to mitigate this risk and ensure system stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel oops, potentially crashing the kernel and causing system instability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in version 6.12.29-1 of the Linux package.
Avoid using rename operations with empty strings as new names until you can apply the update.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37956.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
