CVE-2025-21748
A critical integer overflow in the Linux kernel’s ksmbd service can corrupt memory on 32‑bit systems. The flaw allows attackers to potentially gain full control of the affected machine. A kernel patch has been released to prevent the overflow.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel on 32‑bit systems that use the ksmbd SMB service, including most 32‑bit Linux distributions exposing SMB shares.
Real-world impact
An attacker could exploit the overflow to corrupt memory, leading to arbitrary code execution, data loss, or denial of service on the affected system.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no user interaction, and can compromise confidentiality, integrity, and availability. The integer overflow allows attackers to write arbitrary data, giving them full control of the system.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the ksmbd integer overflow fix.
NVD-referenced vendor advisory
Timeline
- Feb 27, 2025 · Feb 27, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/760568c1f62ea874e8…patch
- git.kernel.org/stable/c/82f59d64e6297f2703…patch
- git.kernel.org/stable/c/aab98e2dbd648510f8…patch
- git.kernel.org/stable/c/b4b902737746c49025…patch
- git.kernel.org/stable/c/ecb9947fa7c99a77b0…patch
- git.kernel.org/stable/c/f3b9fb2764591d792d…
- lists.debian.org/debian-lts-announce/2025/03…