A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the intended anti-brute-force protection, potentially allowing attackers to conduct dictionary attacks more efficiently against user credentials or other authentication mechanisms.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Aug 4, 2025 | Aug 4, 2025 |
| Ubuntu | — | Upgrade linux-ibm-5.15Upgrade linux-intel-iotgUpgrade linux-oracleUpgrade linux-ibmUpgrade linux-gcp-fipsUpgrade linux-gcpUpgrade linux-gkeopUpgrade linux-intel-iot-realtimeUpgrade linux-riscv-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-fipsUpgrade linux-nvidiaUpgrade linux-azure-5.15Upgrade linux-nvidia-tegraUpgrade linux-azure-fde-5.15Upgrade linux-aws-fipsUpgrade linuxUpgrade linux-azure-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-lowlatency-hwe-5.15Upgrade linux-oracle-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-raspiUpgrade linux-awsUpgrade linux-gkeUpgrade linux-gcp-5.15Upgrade linux-hwe-5.15Upgrade linux-bluefieldUpgrade linux-aws-5.15Upgrade linux-realtimeUpgrade linux-azureUpgrade linux-lowlatencyUpgrade linux-kvm | Aug 7, 2025 | Jul 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub