CVE-2025-39975

{
  "id": "CVE-2025-39975",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-10-15T08:15:35.273",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix wrong index reference in smb2_compound_op()\n\nIn smb2_compound_op(), the loop that processes each command's response\nuses wrong indices when accessing response bufferes.\n\nThis incorrect indexing leads to improper handling of command results.\nAlso, if incorrectly computed index is greather than or equal to\nMAX_COMPOUND, it can cause out-of-bounds accesses."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: corrige referencia de índice incorrecta en smb2_compound_op()\n\nEn smb2_compound_op(), el bucle que procesa la respuesta de cada comando usa índices incorrectos al acceder a los búferes de respuesta.\n\nEsta indexación incorrecta lleva a un manejo inadecuado de los resultados del comando. Además, si el índice calculado incorrectamente es mayor o igual que MAX_COMPOUND, puede causar accesos fuera de límites."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/smb/client/smb2inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5ddcc9e92d54548219985ce4de88618fb53e14ec",
              "lessThan": "ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "efe8db3ecaa40a8520dc9a54283dcecd82ceea9c",
              "lessThan": "bfb1e2aad1fecef8320fd71332acde0d53a8d699",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3681c74d342db75b0d641ba60de27bf73e16e66b",
              "lessThan": "093615fc76063ea08d454ba86677ce64c736e806",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3681c74d342db75b0d641ba60de27bf73e16e66b",
              "lessThan": "fbe2dc6a9c7318f7263f5e4d50f6272b931c5756",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "77aefd1d9b790f60634adebbdcfffbe934f41c34",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6.6.75",
              "lessThan": "6.6.109",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.12.12",
              "lessThan": "6.12.50",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.13.1",
              "lessThan": "6.14",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/smb/client/smb2inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.14",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.14",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.109",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.50",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.16.10",
              "lessThanOrEqual": "6.16.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/093615fc76063ea08d454ba86677ce64c736e806",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bfb1e2aad1fecef8320fd71332acde0d53a8d699",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fbe2dc6a9c7318f7263f5e4d50f6272b931c5756",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}