CVE-2025-39929 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2025-39929?

CVE-2025-39929 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's SMB client implementation. When SMB Direct negotiation fails, the kernel fails to properly clean up allocated memory, leading to resource exhaustion over time. This affects all Linux systems using the SMB client with SMB Direct enabled.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's SMB client implementation. When SMB Direct negotiation fails, the kernel fails to properly clean up allocated memory, leading to resource exhaustion over time. This affects all Linux systems using the SMB client with SMB Direct enabled.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches exist for multiple stable branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when SMB Direct (RDMA) is enabled and used for SMB connections. Standard SMB without RDMA is not affected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could cause kernel memory exhaustion leading to system instability, denial of service, or potential kernel panic.

🟠

Likely Case

Gradual memory consumption causing performance degradation and eventual system instability requiring reboot.

🟢

If Mitigated

Minimal impact with proper monitoring and memory limits in place.

🌐 Internet-Facing: LOW - Requires SMB client connections to be initiated from the vulnerable system.

🏢 Internal Only: MEDIUM - Internal SMB connections could trigger the vulnerability if SMB Direct is used.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to trigger SMB Direct negotiation failures, which typically requires network access to SMB servers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commit hashes provided in references

Vendor Advisory: https://git.kernel.org/stable/c/0991418bf98f191d0c320bd25245fcffa1998c7e

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable SMB Direct

linux

Prevent use of SMB Direct (RDMA) for SMB connections

echo 'options cifs rdma=0' > /etc/modprobe.d/cifs-disable-rdma.conf
reboot

🧯 If You Can't Patch

Disable SMB Direct functionality completely
Implement strict network controls to limit SMB connections to trusted servers only

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if SMB Direct is enabled in cifs module parameters

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and check for memory leak patterns in /proc/meminfo over time

📡 Detection & Monitoring

Log Indicators:

Kernel oom-killer messages
Increasing memory usage in system logs
SMB connection failure logs

Network Indicators:

SMB Direct (RDMA) connection attempts
SMB negotiation failures

SIEM Query:

source="kernel" AND ("oom" OR "out of memory" OR "slab")

📊 Metadata

CVE ID: CVE-2025-39929

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.03% exploit probability (9.1th percentile)

Published: October 4, 2025

Last Updated: January 27, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-39929, you might also want to check these: