CVE-2025-40099: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40099 is an out-of-bounds (OOB) memory access vulnerability in the Linux kernel's CIFS (Common Internet File System) component, specifically in the parse_dfs_referrals function. A malicious SMB server can send a crafted invalid reply to FSCTL_DFS_GET_REFERRALS — either smaller than sizeof(struct get_dfs_referral_rsp) or with fewer referrals than declared in the NumberOfReferrals header field — triggering out-of-bounds memory access. The vulnerability was published on October 30, 2025, and affects the Linux kernel across multiple stable branches. It carries a CVSS v3.1 base score of 6.3 (Medium) (Red Hat Advisory, MSRC).

The root cause is insufficient validation of server-supplied data in the parse_dfs_referrals function within the Linux kernel's CIFS subsystem (CWE-125: Out-of-bounds Read). When a Linux client sends a FSCTL_DFS_GET_REFERRALS request to an SMB server, the response is parsed without adequately checking that the reply buffer meets the minimum expected size (sizeof(struct get_dfs_referral_rsp)) or that the actual number of referral entries matches the NumberOfReferrals field in the response header. The fix returns -EINVAL on malformed replies to prevent OOB memory access. Exploitation requires the attacker to control or impersonate an SMB server that the victim client connects to (Red Hat Advisory, EUVD).

Successful exploitation can result in out-of-bounds memory reads, potentially exposing sensitive kernel memory contents (confidentiality impact), and may cause system crashes or kernel panics (availability impact). In more severe scenarios, memory corruption could theoretically enable remote code execution, though this has not been demonstrated publicly. The vulnerability is scoped to the affected system without lateral movement potential inherent to the flaw itself, but kernel-level memory disclosure could facilitate privilege escalation or further attacks (Red Hat Advisory, EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires the attacker to act as a malicious or compromised SMB server that the victim client connects to, which limits opportunistic exploitation (Red Hat Advisory).

Patches have been released for multiple Linux kernel stable branches: 6.1.158, 6.6.114, 6.12.55, 6.17.5, and 6.18-rc2 (EUVD, MSRC). Downstream distributions including Debian (DSA-6053-1, DLA-4379-1), openSUSE, SUSE, and Oracle Linux have issued updated kernel packages. As interim mitigations, administrators should restrict SMB client access to trusted servers only, use network segmentation to limit exposure to untrusted SMB servers, and monitor SMB traffic for anomalies. Upgrading to a patched kernel version is the recommended remediation.