[SRU][J][PATCH 0/1] CVE-2025-37956

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-37956

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: prevent rename with empty string

Client can send empty newname string to ksmbd server. It will cause a kernel
oops from d_alloc. This patch return the error when attempting to rename a file
or directory with an empty new name string.

[ Fix ]

jammy/linux: backported from 53e3e5babc09

The upstream fix adds a check that rejects a rename request whose new name is
an empty string, returning an error instead of proceeding into d_alloc. In the
jammy tree the affected file is fs/ksmbd/smb2pdu.c (renamed to
fs/smb/server/smb2pdu.c upstream). This tree's smb2_get_name does not carry the
leading-slash check that appears as context in the upstream commit, so only the
empty-string ('\0') guard was applied.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix would primarily affect systems that enable the in-kernel SMB server
(ksmbd) and export shares to SMB clients, where a regression could cause
otherwise valid rename operations to fail. Systems that do not load or use the
ksmbd module are not affected by this change.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: d7e893b7/v1