---
id: CVE-2025-40099
title: 'cifs: parse_dfs_referrals: prevent oob on malformed input'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cifs: parse_dfs_referrals: prevent oob on malformed input

  Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS

  - reply smaller than sizeof(struct ge…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad <
    cfacc7441f760e4a73cc71b6ff1635261d534657
  - >-
    Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad <
    15c73964da9df994302f579ed14ee5fdbce7a332
  - >-
    Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad <
    8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058
  - >-
    Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad <
    bb0f2e66e1ac043a5b238f5bcab4f26f3c317039
  - >-
    Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad <
    6447b0e355562a1ff748c4a2ffb89aae7e84d2c9
  - Linux 4.11
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:56:50.620033Z'
published: '2025-10-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:37.745Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40099'
references:
  - url: 'https://git.kernel.org/stable/c/cfacc7441f760e4a73cc71b6ff1635261d534657'
  - url: 'https://git.kernel.org/stable/c/15c73964da9df994302f579ed14ee5fdbce7a332'
  - url: 'https://git.kernel.org/stable/c/8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058'
  - url: 'https://git.kernel.org/stable/c/bb0f2e66e1ac043a5b238f5bcab4f26f3c317039'
  - url: 'https://git.kernel.org/stable/c/6447b0e355562a1ff748c4a2ffb89aae7e84d2c9'
tags:
  - cve.org
epss: 0.0041
epssPercentile: 0.35033
ingestedAt: '2026-10-15T22:48:25.546Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cifs: parse_dfs_referrals: prevent oob on malformed input

Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS

- reply smaller than sizeof(struct get_dfs_referral_rsp)
- reply with number of referrals smaller than NumberOfReferrals in the
header

Processing of such replies will cause oob.

Return -EINVAL error on such replies to prevent oob-s.

## Affected

- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < cfacc7441f760e4a73cc71b6ff1635261d534657`
- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 15c73964da9df994302f579ed14ee5fdbce7a332`
- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058`
- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < bb0f2e66e1ac043a5b238f5bcab4f26f3c317039`
- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 6447b0e355562a1ff748c4a2ffb89aae7e84d2c9`
- `Linux 4.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.