CVE-2025-21946

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21946
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21946.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-21946
Downstream
Published
2025-04-01T15:41:08.955Z
Modified
2025-11-20T08:54:16.745218Z
Summary
ksmbd: fix out-of-bounds in parse_sec_desc()
Details

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix out-of-bounds in parsesecdesc()

If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when validating sid, It need to check it included subauth array size.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0626e6641f6b467447c81dd7678a69c66f7746cf
Fixed
c1569dbbe2d43041be9f3fef7ca08bec3b66ad1b
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0626e6641f6b467447c81dd7678a69c66f7746cf
Fixed
159d059cbcb0e6d0e7a7b34af3862ba09a6b22d1
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0626e6641f6b467447c81dd7678a69c66f7746cf
Fixed
6a9831180d0b23b5c97e2bd841aefc8f82900172
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0626e6641f6b467447c81dd7678a69c66f7746cf
Fixed
d6e13e19063db24f94b690159d0633aaf72a0f03

Affected versions

v5.*

v5.13
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.2
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.13.1
v6.13.2
v6.13.3
v6.13.4
v6.13.5
v6.13.6
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.35
v6.6.36
v6.6.37
v6.6.38
v6.6.39
v6.6.4
v6.6.40
v6.6.41
v6.6.42
v6.6.43
v6.6.44
v6.6.45
v6.6.46
v6.6.47
v6.6.48
v6.6.49
v6.6.5
v6.6.50
v6.6.51
v6.6.52
v6.6.53
v6.6.54
v6.6.55
v6.6.56
v6.6.57
v6.6.58
v6.6.59
v6.6.6
v6.6.60
v6.6.61
v6.6.62
v6.6.63
v6.6.64
v6.6.65
v6.6.66
v6.6.67
v6.6.68
v6.6.69
v6.6.7
v6.6.70
v6.6.71
v6.6.72
v6.6.73
v6.6.74
v6.6.75
v6.6.76
v6.6.77
v6.6.78
v6.6.79
v6.6.8
v6.6.80
v6.6.81
v6.6.82
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "id": "CVE-2025-21946-02ab124b",
        "signature_version": "v1",
        "digest": {
            "function_hash": "19099296053796741556844639453610125499",
            "length": 186.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1569dbbe2d43041be9f3fef7ca08bec3b66ad1b",
        "target": {
            "file": "fs/smb/server/smbacl.c",
            "function": "parse_sid"
        }
    },
    {
        "id": "CVE-2025-21946-285bd8ba",
        "signature_version": "v1",
        "digest": {
            "function_hash": "258078032066190631118018421790195541710",
            "length": 1918.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1569dbbe2d43041be9f3fef7ca08bec3b66ad1b",
        "target": {
            "file": "fs/smb/server/smbacl.c",
            "function": "parse_sec_desc"
        }
    },
    {
        "id": "CVE-2025-21946-3e962e98",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "321500570208980088437105456298835268821",
                "298176824356441214070682504711865561728",
                "178964263320080926020968170826905452834",
                "157866493693322724327318952073456228462",
                "247683979836895939794261798826849696557",
                "191190868189354746862640349611432480390",
                "37447734809255747160044747295773634367",
                "330383751235527500066216681320073379353",
                "71722242097975101731183357493673707816",
                "4614412946290268582447730321736453728",
                "176022032923928307284732436215610819589",
                "306740485436755956425744036835404294340",
                "26801208305940560052485917678478168141",
                "221045083935900005275131855180403088190",
                "65130813212430896086221299491372869325"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@159d059cbcb0e6d0e7a7b34af3862ba09a6b22d1",
        "target": {
            "file": "fs/smb/server/smbacl.c"
        }
    },
    {
        "id": "CVE-2025-21946-4b19303d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "321500570208980088437105456298835268821",
                "298176824356441214070682504711865561728",
                "178964263320080926020968170826905452834",
                "157866493693322724327318952073456228462",
                "247683979836895939794261798826849696557",
                "191190868189354746862640349611432480390",
                "37447734809255747160044747295773634367",
                "330383751235527500066216681320073379353",
                "71722242097975101731183357493673707816",
                "4614412946290268582447730321736453728",
                "176022032923928307284732436215610819589",
                "306740485436755956425744036835404294340",
                "26801208305940560052485917678478168141",
                "221045083935900005275131855180403088190",
                "65130813212430896086221299491372869325"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6e13e19063db24f94b690159d0633aaf72a0f03",
        "target": {
            "file": "fs/smb/server/smbacl.c"
        }
    },
    {
        "id": "CVE-2025-21946-6c477571",
        "signature_version": "v1",
        "digest": {
            "function_hash": "19099296053796741556844639453610125499",
            "length": 186.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a9831180d0b23b5c97e2bd841aefc8f82900172",
        "target": {
            "file": "fs/smb/server/smbacl.c",
            "function": "parse_sid"
        }
    },
    {
        "id": "CVE-2025-21946-7adb0de8",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "321500570208980088437105456298835268821",
                "298176824356441214070682504711865561728",
                "178964263320080926020968170826905452834",
                "157866493693322724327318952073456228462",
                "247683979836895939794261798826849696557",
                "191190868189354746862640349611432480390",
                "37447734809255747160044747295773634367",
                "330383751235527500066216681320073379353",
                "71722242097975101731183357493673707816",
                "4614412946290268582447730321736453728",
                "176022032923928307284732436215610819589",
                "306740485436755956425744036835404294340",
                "26801208305940560052485917678478168141",
                "221045083935900005275131855180403088190",
                "65130813212430896086221299491372869325"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a9831180d0b23b5c97e2bd841aefc8f82900172",
        "target": {
            "file": "fs/smb/server/smbacl.c"
        }
    },
    {
        "id": "CVE-2025-21946-7cdb3115",
        "signature_version": "v1",
        "digest": {
            "function_hash": "258078032066190631118018421790195541710",
            "length": 1918.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6e13e19063db24f94b690159d0633aaf72a0f03",
        "target": {
            "file": "fs/smb/server/smbacl.c",
            "function": "parse_sec_desc"
        }
    },
    {
        "id": "CVE-2025-21946-acc1fa1d",
        "signature_version": "v1",
        "digest": {
            "function_hash": "258078032066190631118018421790195541710",
            "length": 1918.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@159d059cbcb0e6d0e7a7b34af3862ba09a6b22d1",
        "target": {
            "file": "fs/smb/server/smbacl.c",
            "function": "parse_sec_desc"
        }
    },
    {
        "id": "CVE-2025-21946-b007741f",
        "signature_version": "v1",
        "digest": {
            "function_hash": "19099296053796741556844639453610125499",
            "length": 186.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@159d059cbcb0e6d0e7a7b34af3862ba09a6b22d1",
        "target": {
            "file": "fs/smb/server/smbacl.c",
            "function": "parse_sid"
        }
    },
    {
        "id": "CVE-2025-21946-b1080dff",
        "signature_version": "v1",
        "digest": {
            "function_hash": "258078032066190631118018421790195541710",
            "length": 1918.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a9831180d0b23b5c97e2bd841aefc8f82900172",
        "target": {
            "file": "fs/smb/server/smbacl.c",
            "function": "parse_sec_desc"
        }
    },
    {
        "id": "CVE-2025-21946-de1f6967",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "321500570208980088437105456298835268821",
                "298176824356441214070682504711865561728",
                "178964263320080926020968170826905452834",
                "157866493693322724327318952073456228462",
                "247683979836895939794261798826849696557",
                "191190868189354746862640349611432480390",
                "37447734809255747160044747295773634367",
                "330383751235527500066216681320073379353",
                "71722242097975101731183357493673707816",
                "4614412946290268582447730321736453728",
                "176022032923928307284732436215610819589",
                "306740485436755956425744036835404294340",
                "26801208305940560052485917678478168141",
                "221045083935900005275131855180403088190",
                "65130813212430896086221299491372869325"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1569dbbe2d43041be9f3fef7ca08bec3b66ad1b",
        "target": {
            "file": "fs/smb/server/smbacl.c"
        }
    },
    {
        "id": "CVE-2025-21946-ed9b7549",
        "signature_version": "v1",
        "digest": {
            "function_hash": "19099296053796741556844639453610125499",
            "length": 186.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6e13e19063db24f94b690159d0633aaf72a0f03",
        "target": {
            "file": "fs/smb/server/smbacl.c",
            "function": "parse_sid"
        }
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
6.6.83
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.19
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.7