CVE-2025-22037: Linux ksmbd null pointer dereference in alloc_preauth_hash()

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw is a remotely reachable kernel crash in ksmbd with a high EPSS score, but it only causes denial of service and no public exploit or KEV listing is present.

What it is

The Linux kernel ksmbd SMB server dereferences a null pointer in alloc_preauth_hash() when a client sends a malformed SMB2 negotiate request followed by an SMB2 session setup before the negotiate phase completes. Because conn->preauth_info is not allocated in that state, the session setup path crashes the kernel. The flaw is a denial-of-service condition in the in-kernel SMB server.

Impact

An attacker who can reach the ksmbd service can crash the kernel, causing a denial of service on the affected host. The CVSS vector shows only availability impact (A:H) with no confidentiality or integrity loss.

Attack surface

The flaw is reached over the network through SMB2 negotiate and session setup messages handled by ksmbd. The CVSS vector is AV:L/PR:L, indicating the scoring assumes local access with low privileges, though the underlying protocol interaction is remote in nature; no user interaction is required.

Exploitation

No public exploit is referenced in the record, CISA KEV does not list it, and the only non-patch reference is a ZDI advisory. EPSS is high at 0.67588 (99.277th percentile), suggesting elevated predicted exploitation activity despite the absence of confirmed in-the-wild use.

What to do

• Apply the upstream ksmbd patch from the git.kernel.org stable commits listed in the references, or update to a kernel release containing the fix.
• If ksmbd is not required, disable or do not load the ksmbd module to remove the attack surface.
• Restrict SMB2 access to trusted networks and hosts using firewall rules or network segmentation.
• Monitor for repeated malformed SMB2 negotiate requests followed by session setup attempts against ksmbd.

Detection

• Watch kernel logs for null pointer dereference or oops messages originating from alloc_preauth_hash() or ksmbd.
• Alert on ksmbd crashes or unexpected service restarts correlated with SMB2 negotiate/session setup traffic.
• Inspect SMB2 traffic for negotiate requests that receive error responses immediately followed by session setup attempts.
• Track host reboots or kernel panics on systems running ksmbd.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.