PoC Released for Linux Kernel ksmbd Filesystem Vulnerability

Security researchers have published a working proof-of-concept exploit for the ksmbd filesystem vulnerability CVE-2025-37947, with the PoC described as deterministic and able to trigger an out-of-bounds write. According to the report, the flaw resides in ksmbd_vfs_stream_write() when a writable share is configured with streams_xattr, allowing a write beyond a capped limit by setting pos to 0x10000 and count to 8, which leads to eight bytes past the buffer boundary being written.

The PoC, demonstrated by Norbert Szetei and tested on Ubuntu 22.04.5 LTS with kernel 5.15.0-153-generic, can yield local root access via a controlled memory corruption path. The exploit flow includes spray, free and reclaim steps that produce a use-after-free chain, kernel memory leaks for SMAP, SMEP and KASLR bypasses, and a resulting stack pivot and ROP chain execution.

Upstream patches or distribution updates are advised, with temporary mitigations such as disabling the streams_xattr module or restricting write permissions on SMB shares. This news was reported on 9 October 2025, with the full exploit details and source code available on GitHub.