{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21844","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.778Z","datePublished":"2025-03-12T09:42:00.435Z","dateUpdated":"2026-08-05T11:54:52.911Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:54:52.911Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Add check for next_buffer in receive_encrypted_standard()\n\nAdd check for the return value of cifs_buf_get() and cifs_small_buf_get()\nin receive_encrypted_standard() to prevent null pointer dereference."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the SMB client's receive path (cifs_demultiplex_thread → smb3_receive_transform → receive_encrypted_standard), which parses an encrypted compounded SMB2/SMB3 response arriving from the remote server over TCP/445 or RDMA. The triggering input (a response with a non-zero NextCommand) comes entirely from the remote peer, so the vulnerable code is reached across the network.\nAC:L - A malicious or compromised SMB server reliably reaches the allocation by simply returning a compounded encrypted response with NextCommand set, and can drive the client toward buffer-pool exhaustion with large/compounded responses and many outstanding requests, retrying indefinitely until an allocation fails. No memory-layout or timing condition outside the attacker's influence is needed.\nPR:N - The attacker is the SMB server (or a compromised legitimate server) and needs no account, credentials, or any privilege level on the victim client system. Nothing on the client-side path performs a privilege check before the demultiplex thread parses the response.\nUI:N - Once a share is mounted — including long-lived mounts, automounts, or a server that is compromised after the mount — the server can send the malicious compounded response at any time with no action by any user on the client. Response processing happens asynchronously in the cifsd kernel thread, independent of user activity.\nS:U - The NULL dereference occurs in kernel context on the client and its impact is confined to that kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - cifs_buf_get()/cifs_small_buf_get() returning NULL leads to memcpy() into a NULL destination, which faults immediately on the unmapped zero page; no kernel memory is read out or exposed to the attacker.\nI:N - The faulting write targets address 0 and is aborted by the page fault handler, so no kernel data structure is modified and no control-flow hijack primitive is produced.\nA:H - The unchecked NULL dereference causes a kernel oops in the cifsd demultiplex thread, tearing down the connection handling and typically panicking the system (or on panic_on_oops/hardened configurations, halting it), which is a full denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb2ops.c"],"versions":[{"version":"b03c8099a738a04d2343547ae6a04e5f0f63d3fa","lessThan":"f277e479eea3d1aa18bc712abe1d2bf3dece2e30","status":"affected","versionType":"git"},{"version":"858e73ff25639a0cc1f6f8d2587b62c045867e41","lessThan":"f618aeb6cad2307e48a641379db610abcf593edf","status":"affected","versionType":"git"},{"version":"9f528a8e68327117837b5e28b096f52af4c26a05","lessThan":"24e8e4523d3071bc5143b0db9127d511489f7b3b","status":"affected","versionType":"git"},{"version":"534733397da26de0303057ce0b93a22bda150365","lessThan":"9e5d99a4cf2e23c716b44862975548415fae5391","status":"affected","versionType":"git"},{"version":"eec04ea119691e65227a97ce53c0da6b9b74b0b7","lessThan":"a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd","status":"affected","versionType":"git"},{"version":"eec04ea119691e65227a97ce53c0da6b9b74b0b7","lessThan":"554736b583f529ee159aa95af9a0cbc12b5ffc96","status":"affected","versionType":"git"},{"version":"eec04ea119691e65227a97ce53c0da6b9b74b0b7","lessThan":"860ca5e50f73c2a1cef7eefc9d39d04e275417f7","status":"affected","versionType":"git"},{"version":"5.10.211","lessThan":"5.10.235","status":"affected","versionType":"semver"},{"version":"5.15.150","lessThan":"5.15.179","status":"affected","versionType":"semver"},{"version":"6.1.69","lessThan":"6.1.130","status":"affected","versionType":"semver"},{"version":"6.6.8","lessThan":"6.6.80","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb2ops.c"],"versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","status":"unaffected","versionType":"semver"},{"version":"5.10.235","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.179","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.130","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.80","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.17","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.5","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.211","versionEndExcluding":"5.10.235"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.150","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.69","versionEndExcluding":"6.1.130"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.8","versionEndExcluding":"6.6.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.13.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f277e479eea3d1aa18bc712abe1d2bf3dece2e30"},{"url":"https://git.kernel.org/stable/c/f618aeb6cad2307e48a641379db610abcf593edf"},{"url":"https://git.kernel.org/stable/c/24e8e4523d3071bc5143b0db9127d511489f7b3b"},{"url":"https://git.kernel.org/stable/c/9e5d99a4cf2e23c716b44862975548415fae5391"},{"url":"https://git.kernel.org/stable/c/a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd"},{"url":"https://git.kernel.org/stable/c/554736b583f529ee159aa95af9a0cbc12b5ffc96"},{"url":"https://git.kernel.org/stable/c/860ca5e50f73c2a1cef7eefc9d39d04e275417f7"}],"title":"smb: client: Add check for next_buffer in receive_encrypted_standard()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-21844","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T19:26:41.993251Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-476","description":"CWE-476 NULL Pointer Dereference"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-10-01T19:36:34.743Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T19:38:00.594Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:04:02.128Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}}