CVE-2025-21964 – This CVE-2025-21964 vulnerability in the Linux ... (How to Fix)

Q: What is the severity of CVE-2025-21964?

CVE-2025-21964 has a CVSS score of 5.5 (MEDIUM). This CVE-2025-21964 vulnerability in the Linux kernel's CIFS filesystem driver allows integer overflow when processing the acregmax mount option. Attackers could potentially cause denial of service or kernel crashes by providing specially crafted mount parameters. Systems using CIFS mounts with custom acregmax values are affected.

📋 TL;DR

This CVE-2025-21964 vulnerability in the Linux kernel's CIFS filesystem driver allows integer overflow when processing the acregmax mount option. Attackers could potentially cause denial of service or kernel crashes by providing specially crafted mount parameters. Systems using CIFS mounts with custom acregmax values are affected.

💻 Affected Systems

Products:

Linux kernel CIFS filesystem driver

Versions: Linux kernel versions before the fix commits (check specific stable branches)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when using CIFS mounts with custom acregmax parameter values that trigger integer overflow during conversion to jiffies.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash leading to denial of service, potentially requiring physical or remote console access to restore functionality.

🟠

Likely Case

Local denial of service affecting CIFS mount operations, causing filesystem unavailability for users accessing the affected mount.

🟢

If Mitigated

Minimal impact if proper input validation is implemented or if default configurations are used.

🌐 Internet-Facing: LOW - Requires local access or ability to mount CIFS shares with custom parameters.

🏢 Internal Only: MEDIUM - Internal users with mount privileges could exploit this to cause local denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to mount CIFS shares with malicious parameters. Found through static analysis (SVACE), not known to be actively exploited.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions containing commits: 0252c33cc943e9e48ddfafaa6b1eb72adb68a099, 5f500874ab9b3cc8c169c2ab49f00b838520b9c5, 7489161b1852390b4413d57f2457cd40b34da6cc, 833f2903eb8b70faca7967319e580e9ce69729fc, a13351624a6af8d91398860b8c9d4cf6c8e63de5

Vendor Advisory: https://git.kernel.org/stable/c/0252c33cc943e9e48ddfafaa6b1eb72adb68a099

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Avoid custom acregmax values

linux

Do not use custom acregmax mount options for CIFS shares

# Use default mount options or avoid acregmax parameter

Restrict mount privileges

linux

Limit which users can mount CIFS filesystems

# Configure /etc/fstab with 'user' or 'users' options carefully
# Use sudoers to restrict mount command access

🧯 If You Can't Patch

Restrict CIFS mount operations to trusted users only
Monitor for unusual mount attempts or kernel panic events

🔍 How to Verify

Check if Vulnerable:

Check if system uses CIFS mounts with custom acregmax values and has unpatched kernel version

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits and test CIFS mount operations

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
CIFS mount failures in system logs
Unexpected system reboots

Network Indicators:

Unusual CIFS mount attempts from internal systems

SIEM Query:

source="kernel" AND ("panic" OR "oops") OR source="auth" AND "mount" AND "cifs"

📊 Metadata

CVE ID: CVE-2025-21964

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-190

EPSS Score: 0.09% exploit probability (25.8th percentile)

Published: April 1, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21964, you might also want to check these: