CVE-2025-39933: smb: client: let recv_done verify data_offset, data_length and remaining_data_length
Modified
AliasesUBUNTU-CVE-2025-39933DEBIAN-CVE-2025-39933CGA-2969-m3fm-8h24CGA-29x6-3xvw-cpm4CGA-2rj2-vp58-87p9CGA-3358-p337-pp93CGA-33fp-5g63-66vhCGA-37f7-mf4r-jmw6CGA-3p39-4mw8-5936CGA-4fvm-526m-2m73CGA-4j2f-j7xr-x592CGA-546p-fcwg-h8ghCGA-57j3-5m68-v73mCGA-5q6g-347r-wqjqCGA-5x9c-mhmh-w395CGA-648p-m8fm-mf2qCGA-67f3-c734-6fchCGA-72g6-4xrw-52cwCGA-762q-jw4h-mxhqCGA-78xx-f2g9-xc2jCGA-7ccr-gcpm-fcp5CGA-7fw4-wr83-pq4rCGA-7jg7-hhv7-8c3fCGA-7qq3-qm9x-phq3CGA-7whc-76v3-88gvCGA-8673-gcwq-88rhCGA-8796-vw6m-xr64CGA-87qg-6786-77vxCGA-9xfr-4w47-j8jgCGA-cpgm-wc5p-cqwhCGA-crjm-gg35-jjcjCGA-cvj3-c29f-fv38CGA-fgjx-6464-qhcfCGA-fmjj-9chw-8w62CGA-fp38-vf6c-hh48CGA-fwg8-2646-5986CGA-g4m4-46vp-vhmcCGA-g5qp-g57c-227fCGA-gj4c-5q6v-83mxCGA-grfx-j7rx-3qr9CGA-grpq-h42w-pmrmCGA-h5hw-rjpf-grq4CGA-hqp8-4r97-5468CGA-j57f-hx6f-444qCGA-jjfq-rrj4-hc5xCGA-jq6v-gwf6-vmcqCGA-jrfx-g2p2-gxhxCGA-m34v-325r-grmpCGA-m4qw-rr5j-w3x9CGA-m4xf-72jw-w987CGA-pcwp-279m-wj6pCGA-pfrj-c599-x5p8CGA-prx2-38f7-3547CGA-pwqg-cq59-937hCGA-pxjw-7x9w-c82mCGA-q5q7-2qrr-9639CGA-qghc-83p9-4g36CGA-r3gv-5c73-wphjCGA-rh2p-683r-qmrvCGA-rm4r-6vfp-5g8vCGA-rq4j-3mq4-g98mCGA-rvf2-g97x-8j46CGA-v2c9-r3ch-3x8cCGA-v2wc-34vw-p5xfCGA-vmhw-jxcx-3v78CGA-vqfg-mpjw-m857CGA-vrc2-mvjc-76m5CGA-vw4c-qwx6-84w6CGA-vwx2-jwwr-33gvCGA-w7h4-62j7-qqfjCGA-x7c7-vprc-9hjxCGA-x88j-9fv7-v4p5CGA-x9w9-cvpq-gffvCGA-xfv8-jpc9-fr77CGA-xqmj-cx8w-6j5fCGA-xxrh-fq87-cggm
Published 04-10-2025Last modified 30-10-2026
Vulnerability summary
CVE-2025-39933 is a critical (CVSS 9.4) vulnerability in linux. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 9.4 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
9.4/10
010
Critical · v3.1 (CVE.org)EPSS score
0.35%
0%100%
Low · +0.14 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 15 · Related 2Timeline
- 04-10-2025PublishedVulnerability first disclosed.
- 30-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.1Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesSingle source
Critical 9.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:HSources5 sources · 5.5–9.4
- OSV · UbuntuEcosystem advisory · calculated9.4CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated9.4CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
Increase +0.14 pp
From 0.21% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu147 products
- linuxAll versions (No fix recorded)
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded)
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard5 products
- linux-aws-6.12< 6.12.78-r0 | < 6.12.74-r0 | < 6.12.70-r0 | < 6.12.77-r1 | < 6.12.76-r0 | < 6.12.71-r0 | < 6.12.77-r0 | < 6.12.68-r1 | < 6.12.68-r0 | < 6.12.77-r2 | < 6.12.72-r0 | < 6.12.74-r1 | < 6.12.69-r0 | < 6.12.80-r0 | < 6.12.72-r1
- linux-azure-6.12< 6.12.72-r0 | < 6.12.77-r0 | < 6.12.70-r0 | < 6.12.71-r0 | < 6.12.74-r0 | < 6.12.68-r0 | < 6.12.78-r0 | < 6.12.77-r2 | < 6.12.74-r1 | < 6.12.80-r0 | < 6.12.76-r0 | < 6.12.69-r0 | < 6.12.77-r1
- linux-gcp-6.12< 6.12.74-r1 | < 6.12.68-r0 | < 6.12.70-r0 | < 6.12.76-r0 | < 6.12.77-r0 | < 6.12.68-r1 | < 6.12.72-r0 | < 6.12.74-r0 | < 6.12.80-r0 | < 6.12.77-r2 | < 6.12.69-r0 | < 6.12.77-r1 | < 6.12.78-r0 | < 6.12.71-r0
- linux-qemu-6.12< 6.12.74-r1 | < 6.12.69-r0 | < 6.12.71-r0 | < 6.12.77-r2 | < 6.12.72-r0 | < 6.12.80-r0 | < 6.12.76-r0 | < 6.12.70-r0 | < 6.12.74-r0 | < 6.12.78-r0 | < 6.12.77-r1 | < 6.12.77-r0 | < 6.12.68-r0
- linux-vmware-6.12< 6.12.71-r0 | < 6.12.77-r1 | < 6.12.76-r0 | < 6.12.74-r0 | < 6.12.68-r0 | < 6.12.72-r0 | < 6.12.68-r1 | < 6.12.69-r0 | < 6.12.77-r2 | < 6.12.80-r0 | < 6.12.78-r0 | < 6.12.77-r0 | < 6.12.74-r1 | < 6.12.70-r0
Linux2 products
- linux≥ f198186aa9bbd60fae7a2061f4feec614d880299, < fdc23a47be015fba915c4f9dfd43c65ad4829a35 | ≥ f198186aa9bbd60fae7a2061f4feec614d880299, < f23d5c6b7540ec9b1e73a8ea3b2ae9045248d728 | ≥ f198186aa9bbd60fae7a2061f4feec614d880299, < 241e58de23e7c1bbb9bee526c17d9a0f2a90fbad | ≥ f198186aa9bbd60fae7a2061f4feec614d880299, < 581fb78e0388b78911b0c920e4073737090c8b5f | ≥ f198186aa9bbd60fae7a2061f4feec614d880299, < f57e53ea252363234f86674db475839e5b87102e | 4.16
- linux_kernel≥ 4.16, < 6.16.9 | 6.17:rc1 | 6.17:rc2 | 6.17:rc3 | 6.17:rc4 | 6.17:rc5 | 6.17:rc6
Debian1 product
- linuxAll versions (No fix recorded) | < 6.12.115-2 | < 6.16.9-1
4 vendors · 155 products
