CVE-2025-21994 (GCVE-0-2025-21994)

Vulnerability from cvelistv5 – Published: 2025-04-02 14:00 – Updated: 2026-08-05 11:55
VLAI
Title
ksmbd: fix incorrect validation for num_aces field of smb_acl
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix incorrect validation for num_aces field of smb_acl parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an incorrect validation that we can create an array of size ULONG_MAX. smb_acl has ->size field to calculate actual number of aces in request buffer size. Use this to check invalid num_aces.
Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < c3a3484d9d31b27a3db0fab91fcf191132d65236 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 9c4e202abff45f8eac17989e549fc7a75095f675 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < d0f87370622a853b57e851f7d5a5452b72300f19 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < f6a6721802ac2f12f4c1bbe839a4c229b61866f2 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 1b8b67f3c5e5169535e26efedd3e422172e2db64 (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.180 , ≤ 5.15.* (semver)
Unaffected: 6.1.132 , ≤ 6.1.* (semver)
Unaffected: 6.6.85 , ≤ 6.6.* (semver)
Unaffected: 6.12.21 , ≤ 6.12.* (semver)
Unaffected: 6.13.9 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:40:35.107Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c3a3484d9d31b27a3db0fab91fcf191132d65236",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "9c4e202abff45f8eac17989e549fc7a75095f675",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "d0f87370622a853b57e851f7d5a5452b72300f19",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "f6a6721802ac2f12f4c1bbe839a4c229b61866f2",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "1b8b67f3c5e5169535e26efedd3e422172e2db64",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.85",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.21",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.9",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix incorrect validation for num_aces field of smb_acl\n\nparse_dcal() validate num_aces to allocate posix_ace_state_array.\n\nif (num_aces \u003e ULONG_MAX / sizeof(struct smb_ace *))\n\nIt is an incorrect validation that we can create an array of size ULONG_MAX.\nsmb_acl has -\u003esize field to calculate actual number of aces in request buffer\nsize. Use this to check invalid num_aces."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445, and the malformed `num_aces`/DACL arrives directly in an SMB2_SET_INFO (SMB2_O_INFO_SECURITY) or SMB2_CREATE SD_BUFFER request payload. No local access to the target is needed at any point.\nAC:L - The attacker simply sets the 16/32-bit `num_aces` field of the DACL header to a large value while keeping `pdacl-\u003esize` minimal; the oversized allocations follow deterministically on the first request with no race, no memory-layout dependency, and no non-default configuration beyond ksmbd being enabled.\nPR:L - `smb2_set_info()` is reached only after SMB2 session setup, and it additionally requires `KSMBD_TREE_CONN_FLAG_WRITABLE` on the tree connect plus a valid file handle, so any ordinary share account (or the guest account where the share permits it) suffices \u2014 but unauthenticated access does not.\nUI:N - The attacker completes the session setup, tree connect, open and SET_INFO sequence entirely on its own. No administrator or client-side victim action is involved.\nS:U - The oversized allocations and the misparsed ACL stay entirely within the kernel\u0027s own security authority on the SMB server host; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:L - The same commit removes a `sid.sub_auth[num_subauth - 1]` negative-index read that, with `num_subauth == 0`, reads the four bytes preceding `sub_auth` and feeds them to `sid_to_id()` and the group-SID test. The read is strictly bounded to 4 bytes that lie inside the client\u0027s own request buffer (`end_of_acl` is validated by `ksmbd_smb2_check_message()`), so it is a limited misread rather than an arbitrary kernel-memory disclosure.\nI:L - `parse_dacl()`\u0027s output is applied to the file through `set_posix_acl()` and `notify_change()` in `set_info_sec()`, so an ACL parsed from an unvalidated ACE count and an out-of-bounds `sub_auth[-1]` value yields on-disk permissions and uid/gid mappings that do not correspond to the descriptor sent. This is bounded metadata corruption on files the attacker can already write; the `num_aces`-sized `ppace` and `posix_ace_state_array` writes remain in bounds and the `init_acl_state()` `int` truncation is unreachable because the paired `kmalloc_array()` fails first, so there is no arbitrary-write primitive.\nA:H - A ~120-byte request forces up to ~19 MB of high-order `GFP_KERNEL` allocations (4 \u00d7 ~4 MB `posix_ace_state_array` plus ~2.8 MB `ppace`), a ~200,000\u00d7 amplification, and ksmbd\u0027s 256-slot `ksmbd-io` workqueue lets a few connections drive gigabytes of concurrent order-8/order-10 allocation pressure \u2014 producing direct-reclaim/compaction stalls, page-allocation-failure splats (fatal under `panic_on_warn`), and OOM kills that take down the host, which is especially severe on the NAS, router, and embedded devices where ksmbd is commonly deployed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:53.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c3a3484d9d31b27a3db0fab91fcf191132d65236"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c4e202abff45f8eac17989e549fc7a75095f675"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0f87370622a853b57e851f7d5a5452b72300f19"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6a6721802ac2f12f4c1bbe839a4c229b61866f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b8b67f3c5e5169535e26efedd3e422172e2db64"
        }
      ],
      "title": "ksmbd: fix incorrect validation for num_aces field of smb_acl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21994",
    "datePublished": "2025-04-02T14:00:37.407Z",
    "dateReserved": "2024-12-29T08:45:45.801Z",
    "dateUpdated": "2026-08-05T11:55:53.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21994",
      "date": "2026-08-06",
      "epss": "0.00285",
      "percentile": "0.20617"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21994\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-02T14:16:01.440\",\"lastModified\":\"2026-07-30T06:22:02.047\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix incorrect validation for num_aces field of smb_acl\\n\\nparse_dcal() validate num_aces to allocate posix_ace_state_array.\\n\\nif (num_aces \u003e ULONG_MAX / sizeof(struct smb_ace *))\\n\\nIt is an incorrect validation that we can create an array of size ULONG_MAX.\\nsmb_acl has -\u003esize field to calculate actual number of aces in request buffer\\nsize. Use this to check invalid num_aces.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: Se corrige la validaci\u00f3n incorrecta del campo num_aces de smb_acl. La funci\u00f3n parse_dcal() valida num_aces para asignar posix_ace_state_array. Si (num_aces \u0026gt; ULONG_MAX / sizeof(struct smb_ace *)), se considera una validaci\u00f3n incorrecta que permita crear una matriz de tama\u00f1o ULONG_MAX. smb_acl tiene el campo -\u0026gt;size para calcular el n\u00famero real de ases en el tama\u00f1o del b\u00fafer de solicitud. \u00daselo para comprobar num_aces no v\u00e1lidos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smbacl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"c3a3484d9d31b27a3db0fab91fcf191132d65236\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"9c4e202abff45f8eac17989e549fc7a75095f675\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"d0f87370622a853b57e851f7d5a5452b72300f19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"f6a6721802ac2f12f4c1bbe839a4c229b61866f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"1b8b67f3c5e5169535e26efedd3e422172e2db64\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smbacl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.180\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.132\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.85\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.21\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.9\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.180\",\"matchCriteriaId\":\"BEB9E1BE-C9E4-43F8-873F-48C1E5453116\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.132\",\"matchCriteriaId\":\"91D1C2F6-55A1-4CF4-AC66-ADF758259C59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.85\",\"matchCriteriaId\":\"BCB56F36-C998-496A-A2E4-D9E0BB3A5BFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.21\",\"matchCriteriaId\":\"3B63C450-D73B-4A53-9861-98E25C16E842\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.9\",\"matchCriteriaId\":\"FAECBE4D-58CF-4836-BBAB-5E28B800A778\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b8b67f3c5e5169535e26efedd3e422172e2db64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c4e202abff45f8eac17989e549fc7a75095f675\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3a3484d9d31b27a3db0fab91fcf191132d65236\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0f87370622a853b57e851f7d5a5452b72300f19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f6a6721802ac2f12f4c1bbe839a4c229b61866f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:37:25+00:00",
      "cve": "CVE-2025-21994",
      "id": "CVE-2025-21994",
      "initial_release_date": "2025-04-02T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix incorrect validation for num_aces field of smb_acl",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21994.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:18:26Z",
      "cve": "CVE-2025-21994",
      "id": "CVE-2025-21994",
      "initial_release_date": "2025-04-05T02:24:47Z",
      "product_status:known_not_affected": "455",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21994",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21994.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.