CVE-2025-22037
MediumLinux kernel: ksmbd: fix null pointer dereference in alloc_preauth_hash()
Published Apr 16, 2025 · Updated Oct 13, 2026 · Also known as DEBIAN-CVE-2025-22037, ROOT-OS-DEBIAN-12-CVE-2025-22037, ROOT-OS-UBUNTU-2204-CVE-2025-22037, ROOT-OS-UBUNTU-2404-CVE-2025-22037, UBUNTU-CVE-2025-22037, USN-8059-2, USN-8059-3, USN-8059-7, USN-8059-9
Key Facts
Patch immediately- CVE-2025-22037 is a medium-severity vulnerability (CVSS 5.5 v3.1) affecting linux (debian), rootio-linux, bpftool (ubuntu) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 70% probability of exploitation in the next 30 days.
- Fixed versions are available, including bpftool 7.6.0+6.14.0-22.22, Kernel 6.12.23, Kernel 6.13.11.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
70%
Higher than 99.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2025-22037 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in alloc_preauth_hash()
The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete.
Affected Products
2,136 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| linuxdebian | See advisory | 6.12.25-1 |
| rootio-linuxrootio | See advisory | 6.1.172-1.root.io.132 |
| bpftoolubuntu | See advisory | 7.6.0+6.14.0-22.22 |
| linux-allwinner-5.19ubuntu | See advisory | n/a |
| linux-aws-5.0ubuntu | See advisory | n/a |
Patched Releases
bpftool
7.6.0+6.14.0-22.22
Kernel
6.12.23, 6.13.11, 6.14.2, 6.6.107
kernel-uek
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-core
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-core
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-devel
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-modules
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-modules-core
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-modules-deprecated
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-modules-desktop
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-modules-extra
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-modules-extra-netfilter
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-modules-usb
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-debug-modules-wireless
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-devel
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-doc
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-modules
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-modules-core
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-modules-deprecated
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-modules-desktop
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-modules-extra
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-modules-extra-netfilter
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-modules-usb
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
kernel-uek-modules-wireless
6.12.0-101.33.4.3.el10uek, 6.12.0-101.33.4.3.el9uek, 6.12.0-102.36.5.2.el10uek, 6.12.0-102.36.5.2.el9uek
Timeline
Publicly disclosed
Apr 16, 2025
Last updated
Oct 13, 2026
Weakness Type
- CWE-476 NULL Pointer Dereference
References
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22037.json
- advisoryhttps://git.kernel.org/linus/c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-22037
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2025-22037
- advisoryhttps://ubuntu.com/security/CVE-2025-22037
FAQ
Common Questions.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request.
Affected: linux (debian); rootio-linux; bpftool (ubuntu), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including bpftool 7.6.0+6.14.0-22.22, Kernel 6.12.23, Kernel 6.13.11.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2025-22037 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo