In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix wrong index reference in smb2compoundop()
In smb2compoundop(), the loop that processes each command's response uses wrong indices when accessing response bufferes.
This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index is greather than or equal to MAX_COMPOUND, it can cause out-of-bounds accesses.
[
{
"id": "CVE-2025-39975-2fe7a4b2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfb1e2aad1fecef8320fd71332acde0d53a8d699",
"target": {
"file": "fs/smb/client/smb2inode.c"
},
"digest": {
"line_hashes": [
"106634486174691871409783007978359361559",
"201476189584206989557949521727455272874",
"88885797473067275913567922507237135745",
"204867349501814129717462787270291617459"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2025-39975-7782c5c9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbe2dc6a9c7318f7263f5e4d50f6272b931c5756",
"target": {
"file": "fs/smb/client/smb2inode.c"
},
"digest": {
"line_hashes": [
"209421460244114543087191360151047631848",
"226339553034553113590355411509351755249",
"88885797473067275913567922507237135745",
"204867349501814129717462787270291617459"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2025-39975-871c0a5d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5",
"target": {
"file": "fs/smb/client/smb2inode.c",
"function": "smb2_compound_op"
},
"digest": {
"function_hash": "303289713771056848766008875288036264634",
"length": 14960.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2025-39975-97a8d92c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@093615fc76063ea08d454ba86677ce64c736e806",
"target": {
"file": "fs/smb/client/smb2inode.c",
"function": "smb2_compound_op"
},
"digest": {
"function_hash": "127328616586540871646799335182768790427",
"length": 16153.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2025-39975-9906e550",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@093615fc76063ea08d454ba86677ce64c736e806",
"target": {
"file": "fs/smb/client/smb2inode.c"
},
"digest": {
"line_hashes": [
"209421460244114543087191360151047631848",
"226339553034553113590355411509351755249",
"88885797473067275913567922507237135745",
"204867349501814129717462787270291617459"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2025-39975-b8b958bf",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5",
"target": {
"file": "fs/smb/client/smb2inode.c"
},
"digest": {
"line_hashes": [
"106634486174691871409783007978359361559",
"201476189584206989557949521727455272874",
"88885797473067275913567922507237135745",
"204867349501814129717462787270291617459"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2025-39975-caae4f50",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbe2dc6a9c7318f7263f5e4d50f6272b931c5756",
"target": {
"file": "fs/smb/client/smb2inode.c",
"function": "smb2_compound_op"
},
"digest": {
"function_hash": "127328616586540871646799335182768790427",
"length": 16153.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2025-39975-f5bac2c3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfb1e2aad1fecef8320fd71332acde0d53a8d699",
"target": {
"file": "fs/smb/client/smb2inode.c",
"function": "smb2_compound_op"
},
"digest": {
"function_hash": "198796987702740590042603559122401263560",
"length": 15127.0
},
"deprecated": false,
"signature_version": "v1"
}
]