CVE-2025-21963

MEDIUM5.5

cifs: Fix integer overflow while processing acdirmax mount option

Published Apr 1, 2025

Modified 2 months ago

Details

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix integer overflow while processing acdirmax mount option

User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

References

WEBhttps://git.kernel.org/stable/c/0c26edf477e093cefc41637f5bccc102e1a77399 WEBhttps://git.kernel.org/stable/c/2809a79bc64964ce02e0c5f2d6bd39b9d09bdb3c WEBhttps://git.kernel.org/stable/c/39d086bb3558da9640ef335f97453e01d32578a1 WEBhttps://git.kernel.org/stable/c/5b29891f91dfb8758baf1e2217bef4b16b2b165b WEBhttps://git.kernel.org/stable/c/6124cbf73e3dea7591857dd63b8ccece28952afd WEBhttps://git.kernel.org/stable/c/9e438d0410a4002d24f420f2c28897ba2dc0af64 WEBhttps://lists.debian.org/debian-lts-announce/2025/05/msg00045.html ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-21963

CVSS Analysis

CVSS v3.1

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

5.5/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedApr 1, 2025

ModifiedNov 3, 2025

CVE-2025-21963 | Mondoo Vulnerability Intelligence