CVE-2025-37947 is a high-severity vulnerability in the Linux kernel's ksmbd component. The issue arises because ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data length (v_len). This lack of validation could allow out-of-bounds memory writes. The vulnerability has been resolved by adding a check to ensure *pos is less than v_len before writing, returning -EINVAL if the check fails.