CVE-2025-40084: Linux

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: transport_ipc: validate payload size before reading handle handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Validate the size before dereferencing. This is a minimal fix to guard the initial handle read.

Affected products

• Linux Linux: from 5.15, before 6.1.158 (fixed in 6.1.158); from 6.2, before 6.6.115 (fixed in 6.6.115); from 6.7, before 6.12.56 (fixed in 6.12.56); from 6.13, before 6.17.6 (fixed in 6.17.6)

Published 2025-10-29. Last modified 2026-07-30.