CVE-2025-40099 addresses a critical vulnerability in the Linux kernel's CIFS implementation where a malicious SMB server can send malformed responses to the FSCTL_DFS_GET_REFERRALS request. These responses may be smaller than the expected structure size or contain fewer referrals than indicated, leading to out-of-bounds memory access during processing. The vulnerability is mitigated by validating the reply size and referral count, returning an error to prevent OOB conditions.

Successful exploitation could lead to out-of-bounds memory access in the Linux kernel, potentially causing system crashes or enabling further attacks due to memory corruption. The CVSS vector indicates network attack vector with no privileges or user interaction required, with high confidentiality and availability impact and low integrity impact.

A fix has been implemented in the Linux kernel to return an error (-EINVAL) on malformed DFS referral replies, preventing out-of-bounds memory access. Users should update their Linux kernel to a version that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.