01 Record

CVE-2025-21844

smb: client: Add check for next_buffer in receive_encrypted_standard()

HighPUBLISHEDCNA: Linux

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

smb: client: Add check for next_buffer in receive_encrypted_standard()

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.60% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 46.1% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-07-30.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-03-12 09:42Z1 YR AGO

Last updated

2026-08-05 11:54Z1 MO AGO

Reserved

2024-12-29

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-476NULL Pointer DereferenceBase

Data version

5.2

Document digest

cc298798f941741893175bc4b86049e0a6706cd8d7bf44edaa9dc3100b83d080

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxb03c8099a738a04d2343547ae6a04e5f0f63d3fa to < f277e479eea3d1aa18bc712abe1d2bf3dece2e30, 858e73ff25639a0cc1f6f8d2587b62c045867e41 to < f618aeb6cad2307e48a641379db610abcf593edf, 9f528a8e68327117837b5e28b096f52af4c26a05 to < 24e8e4523d3071bc5143b0db9127d511489f7b3b, 534733397da26de0303057ce0b93a22bda150365 to < 9e5d99a4cf2e23c716b44862975548415fae5391, eec04ea119691e65227a97ce53c0da6b9b74b0b7 to < a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd, eec04ea119691e65227a97ce53c0da6b9b74b0b7 to < 554736b583f529ee159aa95af9a0cbc12b5ffc96, eec04ea119691e65227a97ce53c0da6b9b74b0b7 to < 860ca5e50f73c2a1cef7eefc9d39d04e275417f7, 5.10.211 to < 5.10.235, 5.15.150 to < 5.15.179, 6.1.69 to < 6.1.130, 6.6.8 to < 6.6.80, 6.7—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/f277e479eea3d1aa18bc712abe1d2bf3dece2e30
git.kernel.orghttps://git.kernel.org/stable/c/f618aeb6cad2307e48a641379db610abcf593edf
git.kernel.orghttps://git.kernel.org/stable/c/24e8e4523d3071bc5143b0db9127d511489f7b3b
git.kernel.orghttps://git.kernel.org/stable/c/9e5d99a4cf2e23c716b44862975548415fae5391
git.kernel.orghttps://git.kernel.org/stable/c/a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd
git.kernel.orghttps://git.kernel.org/stable/c/554736b583f529ee159aa95af9a0cbc12b5ffc96
git.kernel.orghttps://git.kernel.org/stable/c/860ca5e50f73c2a1cef7eefc9d39d04e275417f7
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html

01 Record index

CVE-2025-21844

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2025-21844

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References