CVE-2025-22037: exploitation status and patch state
CVE-2025-22037 · CVSS 5.5 MEDIUM · EPSS 66%
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in alloc_preauth_hash()
The Client send malformed smb2 negotiate request. ksmbd return error
response. Subsequently, the client can send smb2 session setup even
thought conn->preauth_info is not allocated.
This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore
session setup request if smb2 negotiate phase is not complete.
Is CVE-2025-22037 exploited?
Not in the CISA KEV catalog.
EPSS puts exploitation in the next 30 days at 66%.
Public exploit code: none found in monitored sources.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2025-22037
PlainSec has not published a story about this CVE.