CVE-2025-22037: Linux Kernel

High severity, CVSS 7.5. EPSS: 69.5% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete.

Affected products

• Linux Linux Kernel: from 6.6, before 6.6.107 (fixed in 6.6.107); from 6.12, before 6.12.23 (fixed in 6.12.23); from 6.13, before 6.13.11 (fixed in 6.13.11); from 6.14, before 6.14.2 (fixed in 6.14.2)

Published 2025-04-16. Last modified 2026-10-08.