CVE-2025-22038: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-22038 is a vulnerability discovered in the Linux kernel's ksmbd component, disclosed on April 16, 2025. The vulnerability involves an out-of-bounds read condition that occurs when accessing psid->subauth[psid->numsubauth - 1] without properly validating if num_subauth is non-zero (NVD, Debian Tracker).

The vulnerability is rated with a CVSS v3.1 base score of 5.5 (Low severity) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue specifically occurs in the ksmbd component where a validation step was missing to ensure numsubauth != 0 before accessing subauth, leading to an out-of-bounds read condition (Red Hat).

The vulnerability results in an out-of-bounds read condition which could potentially lead to information disclosure or system crashes. The attack requires local access to the system and can affect the availability of the service (Red Hat).

The vulnerability has been fixed in Linux kernel version 6.12.25-1. Several distributions have released or are in the process of releasing patches, including Debian which has fixed the issue in sid version 6.12.25-1 (Debian Tracker).