The Linux kernel's ksmbd transport_ipc subsystem had a vulnerability (CVE-2025-40084) where handle_response() would read a 4-byte handle from the payload without verifying that the payload size was at least 4 bytes. This could lead to a 4-byte read beyond the declared payload size if a malformed or truncated message was received from ksmbd.mountd. The vulnerability was addressed by adding validation of the payload size before dereferencing the handle, mitigating the risk of out-of-bounds memory access.

This vulnerability allows an attacker with local privileges and low complexity to cause a high impact on confidentiality and availability by reading memory beyond the intended payload boundary. The CVSS vector indicates no user interaction is required and privileges are low, making it a high-severity issue. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to validate the payload size before reading the handle in ksmbd. Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed — check the vendor advisory or Linux kernel mailing lists for current remediation guidance.