CVE-2025-37956: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-37956) was identified in the Linux kernel's ksmbd component, discovered and published on May 20, 2025. The issue involves improper validation of rename operations in the kernel SMB server where a client can send an empty newname string to the ksmbd server (NVD Database, Wiz Database).

The vulnerability exists in the ksmbd (kernel SMB server) component of the Linux kernel. When a client sends an empty newname string during a rename operation, it triggers a kernel oops due to a failure in the d_alloc function. The vulnerability has been assigned a CVSS 3.1 score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

When exploited, this vulnerability results in a kernel oops, which can lead to system instability and potential denial of service conditions. The primary impact is on system availability as the kernel oops disrupts normal system operations (Wiz Database).

A patch has been developed that adds validation to prevent rename operations with empty newname strings. The fix returns an error when attempting to rename a file or directory with an empty new name string (NVD Database).