Linux Kernel ksmbd Filesystem Vulnerability Exploited – PoC Released

Security researchers have disclosed a proof-of-concept (PoC) exploit for a high-severity vulnerability in the Linux kernel's ksmbd module, which allows for local privilege escalation.

Identified as CVE-2025-37947, this vulnerability is an out-of-bounds write exploitable by an authenticated local attacker to obtain root access on affected systems.

The vulnerability was uncovered through extensive research by Doyensec on the kernel-level Server Message Block (SMB) server, increasingly utilized in recent Linux versions. Its public exploit release highlights the potential risk to systems using the vulnerable kernel module.

The core issue of CVE-2025-37947 resides in the ksmbd_vfs_stream_write() function, which manages write operations to file streams via extended attributes. The vulnerability can be triggered when ksmbd is configured with a writable share and the streams_xattr VFS module is active.

The vulnerability results from inadequate size validation when a user-supplied position and data count exceed the XATTR_SIZE_MAX limit of 65,536 bytes. Although the buffer allocation size is truncated, the memcpy count is not adjusted, allowing data to overflow the allocated buffer, causing memory corruption.

The researchers from Doyensec explained how the out-of-bounds write can escalate to a full root exploit on systems like Ubuntu 22.04.5 LTS. The exploit involves a multi-step process starting with heap shaping to modify the kernel's memory layout.

By strategically allocating and freeing kernel objects, attackers can position a controlled victim object, such as a msg_msg kernel message structure, next to the vulnerable buffer.

The out-of-bounds write corrupts the msg_msg header, creating a use-after-free (UAF) condition. This UAF is used to reveal kernel memory addresses, overcoming Kernel Address Space Layout Randomization (KASLR).

Once KASLR is bypassed, the exploit overwrites a function pointer in a pipe_buffer object, redirecting the kernel's control flow to execute a ROP chain that grants root access.

The complete local privilege escalation exploit has been published on GitHub , enabling security experts to assess its impact on their systems. While the current exploit targets local access, remote exploitation would require additional vulnerabilities, such as information disclosure, to defeat KASLR and facilitate heap grooming.

This vulnerability is part of a broader security analysis of ksmbd by Doyensec, which has also identified other critical issues like unauthenticated race conditions and memory exhaustion flaws. System administrators should review their ksmbd usage and apply patches for CVE-2025-37947 as they become available from their Linux distribution providers.

Based on reporting by Cyber Security News.