CVE-2025-37947
Description
From CVE.org
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating *pos ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data length (v_len). If *pos was greater than or equal to v_len, this could lead to an out-of-bounds memory write. This patch adds a check to ensure *pos is less than v_len before proceeding. If the condition fails, -EINVAL is returned.
Statement
This vulnerability does not impact Red Hat Enterprise Linux as the in-kernel SMB server (ksmbd) is not enabled or supported in Red Hat kernels. Red Hat provides SMB file-sharing services through the user-space Samba daemon rather than the kernel-based ksmbd module. Consequently, supported Red Hat products do not contain the vulnerable code and are not susceptible to this flaw.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
