CVE-2025-22037

CVE-2025-22037 is a NULL pointer dereference (CWE-476) in alloc_preauth_hash() in ksmbd, the SMB3 file server implemented inside the Linux kernel. A client sends a malformed SMB2 negotiate request, ksmbd returns an error response, but the connection then accepts a subsequent SMB2 session setup request while conn->preauth_info has never been allocated, causing the server to dereference a NULL pointer. Because ksmbd runs in kernel space, the fault crashes the kernel, so an attacker gains denial of service of the affected host; the scored vector shows no confidentiality or integrity impact. Any Linux system with the ksmbd subsystem enabled and serving SMB2 sessions is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in the CISA KEV catalog, although EPSS assigns a relatively high 66.4% probability of exploitation within 30 days.

What to do: Update the kernel to a build that includes the upstream ksmbd fix (the patch adding the KSMBD_SESS_NEED_SETUP state; check your distribution for patched kernel packages). Check whether ksmbd is in use (e.g. lsmod | grep ksmbd or the ksmbd service) and disable or unload the module, or restrict TCP/445 access, on hosts that do not need to serve SMB. Although no PoC or in-the-wild exploitation is confirmed, EPSS is high, so prioritize patching hosts exposing ksmbd to untrusted clients.