[SRU][J][PATCH 0/1] CVE-2025-21947

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-21947

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc.
req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be
same and it could lead to type confusion between messages, resulting in access
to unexpected parts of memory after an incorrect delivery. ksmbd check type of
ipc response but missing add continue to check next ipc reponse.

The ksmbd server allocates IPC message handles from a shared IDA pool that is
used both by login requests and by FSCTL_PIPE_TRANSCEIVE ioctls. Because the
same handle value can be handed out to different request types, a response may
be matched to the wrong pending request. When ksmbd validates the response
type and finds a mismatch, it fails to continue looking for the correct
response, so a message can be interpreted as a different structure than the one
it actually is. This type confusion allows a remote client to cause the server
to access unexpected regions of kernel memory.

[ Fix ]

jammy/linux: backported from e2ff19f0b7a3; backported to jammy/linux; review and refine this note

The fix ensures that when the IPC response type does not match the expected
type, the handler continues to scan for the next response rather than acting on
a mismatched message, closing the type-confusion window introduced by the
shared handle allocation.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A regression from this change would be confined to the in-kernel SMB server
(ksmbd); it could disrupt IPC handling between the kernel module and the
ksmbd user-space daemon, potentially affecting user authentication or named
pipe (RPC) traffic for hosts that export SMB shares via ksmbd. Systems that do
not load or run the ksmbd module, including those serving SMB through Samba's
user-space smbd or not serving SMB at all, are not affected.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: 339f80a1/v1