CVE-2025-37750: linux kernel from 5.10.237 (inclusive), before 5.11 (exclusive), from 5.15.181 (inclusive), before 5.16 (exclusive)…

Affected technology

linux kernel · from 5.10.237 (inclusive), before 5.11 (exclusive)
linux

linux kernel · from 5.15.181 (inclusive), before 5.16 (exclusive)
linux

linux kernel · from 6.1.128 (inclusive), before 6.2 (exclusive)
linux

linux kernel · from 6.6.57 (inclusive), before 6.7 (exclusive)
linux

linux kernel · from 6.11.4 (inclusive), before 6.12.24 (exclusive)
linux

linux kernel · from 6.13 (inclusive), before 6.13.12 (exclusive)
linux

linux kernel · from 6.14 (inclusive), before 6.14.3 (exclusive)
linux

linux kernel · 6.15 · update rc1
linux

Linux · c8c6af46286a513769650935ff858fc67cf51a6d to before 08160de2a65227e5b64fcb6765cd936ec384ee93, b0abcd65ec545701b8793e12bc27dc98042b151a to before aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15, b0abcd65ec545701b8793e12bc27dc98042b151a to before e859b216d94668bc66330e61be201234f4413d1a, b0abcd65ec545701b8793e12bc27dc98042b151a to before 950557922c1298464749c216d8763e97faf5d0a6, b0abcd65ec545701b8793e12bc27dc98042b151a to before 9502dd5c7029902f4a425bf959917a5a9e7c0e50, 8f14a476abba13144df5434871a7225fd29af633, ef51c0d544b1518b35364480317ab6d3468f205d, bce966530fd5542bbb422cb45ecb775f7a1a6bc3, 0809fb86ad13b29e1d6d491364fc7ea4fb545995, 538c26d9bf70c90edc460d18c81008a4e555925a, 5.10.237 to before 5.11, 5.15.181 to before 5.16, 6.1.128 to before 6.2, 6.11.4 to before 6.12
Linux

Linux · 6.12
Linux

Component: Not specified by the source
File: fs/smb/client/cifsencrypt.c, fs/smb/client/smb2ops.c, fs/smb/client/smb2pdu.c

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.