CVE-2025-40090: linux kernel from 6.12.53 (inclusive), before 6.12.55 (exclusive), from 6.17.3 (inclusive), before 6.17.5 (exclusive)…

Affected technology

linux kernel · from 6.12.53 (inclusive), before 6.12.55 (exclusive)
linux

linux kernel · from 6.17.3 (inclusive), before 6.17.5 (exclusive)
linux

linux kernel · 6.18 · update rc1
linux

Linux · 69674b029002b1d90b655f014bdf64f404efa54d to before 5493571f4351f74e11db9943e98a07c56467cf7e, 6b615a8fb3af0baf8126cde3d4fee97d57222ffc to before 1891abe832cbf5a11039e088766131d0f1642d02, 5cc679ba0f4505936124cd4179ba66bb0a4bd9f3 to before 4602b8cee1481dbb896182e5cb1e8cf12910e9e7, 6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1 to before 3412fbd81b46b9cfae013817b61d4bbd27e09e36, 305853cce379407090a73b38c5de5ba748893aee to before 88f170814fea74911ceab798a43cbd7c5599bed4
Linux

Linux · 6.12.53 to before 6.12.55, 6.17.3 to before 6.17.5
Linux

Component: Not specified by the source
File: fs/smb/server/mgmt/user_session.c, fs/smb/server/smb2pdu.c, fs/smb/server/transport_ipc.c

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.