In the Linux kernel, the following vulnerability has been resolved:
cifs: parsedfsreferrals: prevent oob on malformed input
Malicious SMB server can send invalid reply to FSCTLDFSGET_REFERRALS
Processing of such replies will cause oob.
Return -EINVAL error on such replies to prevent oob-s.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb0f2e66e1ac043a5b238f5bcab4f26f3c317039",
"id": "CVE-2025-40099-15ec9263",
"deprecated": false,
"target": {
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147589201996759539946619438037629030474",
"33657662782712854394588607892687616883",
"280691658804689906839355126145776874866",
"45210451920535755021650276718166601399",
"266332681510116457990081226242450529928",
"20104730243819086531917265464818486539"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15c73964da9df994302f579ed14ee5fdbce7a332",
"id": "CVE-2025-40099-25b08fa0",
"deprecated": false,
"target": {
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147589201996759539946619438037629030474",
"33657662782712854394588607892687616883",
"269191072180807446240384929874669220063",
"7579206383452455485415493487608048125",
"266332681510116457990081226242450529928",
"20104730243819086531917265464818486539"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfacc7441f760e4a73cc71b6ff1635261d534657",
"id": "CVE-2025-40099-73fdd7aa",
"deprecated": false,
"target": {
"function": "parse_dfs_referrals",
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"length": 2260.0,
"function_hash": "155861650637015023987634431924451637071"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6447b0e355562a1ff748c4a2ffb89aae7e84d2c9",
"id": "CVE-2025-40099-7b55b0b9",
"deprecated": false,
"target": {
"function": "parse_dfs_referrals",
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"length": 2283.0,
"function_hash": "245185247152501184557042755324084767050"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058",
"id": "CVE-2025-40099-802fe231",
"deprecated": false,
"target": {
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147589201996759539946619438037629030474",
"33657662782712854394588607892687616883",
"269191072180807446240384929874669220063",
"7579206383452455485415493487608048125",
"266332681510116457990081226242450529928",
"20104730243819086531917265464818486539"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb0f2e66e1ac043a5b238f5bcab4f26f3c317039",
"id": "CVE-2025-40099-aa1d4cc8",
"deprecated": false,
"target": {
"function": "parse_dfs_referrals",
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"length": 2283.0,
"function_hash": "245185247152501184557042755324084767050"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058",
"id": "CVE-2025-40099-bebd8b8a",
"deprecated": false,
"target": {
"function": "parse_dfs_referrals",
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"length": 2260.0,
"function_hash": "155861650637015023987634431924451637071"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6447b0e355562a1ff748c4a2ffb89aae7e84d2c9",
"id": "CVE-2025-40099-ce512b52",
"deprecated": false,
"target": {
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147589201996759539946619438037629030474",
"33657662782712854394588607892687616883",
"280691658804689906839355126145776874866",
"45210451920535755021650276718166601399",
"266332681510116457990081226242450529928",
"20104730243819086531917265464818486539"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15c73964da9df994302f579ed14ee5fdbce7a332",
"id": "CVE-2025-40099-ef07ed35",
"deprecated": false,
"target": {
"function": "parse_dfs_referrals",
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"length": 2260.0,
"function_hash": "155861650637015023987634431924451637071"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfacc7441f760e4a73cc71b6ff1635261d534657",
"id": "CVE-2025-40099-f39d5db3",
"deprecated": false,
"target": {
"file": "fs/smb/client/misc.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147589201996759539946619438037629030474",
"33657662782712854394588607892687616883",
"269191072180807446240384929874669220063",
"7579206383452455485415493487608048125",
"266332681510116457990081226242450529928",
"20104730243819086531917265464818486539"
]
},
"signature_type": "Line"
}
]