The vulnerability lives in ksmbd_vfs_stream_write() (fs/ksmbd/vfs.c, introduced by commit 0626e6641f6b467447c81dd7678a69c66f7746cf). When a client writes to a named data stream (an extended-attribute-backed alternate data stream managed by the streams_xattr VFS module) and the requested write position/count exceeds XATTR_SIZE_MAX (65536 bytes / 16 pages), the function truncates the kvzalloc() allocation size to 0x10000 bytes but the subsequent memcpy(&stream_buf[*pos], buf, count) still uses the original, untruncated count and unchecked *pos, writing attacker-controlled data past the end of the allocated stream buffer into adjacent kernel heap memory. The upstream fix adds a bounds check ensuring *pos is less than the existing stream data length (v_len) before the write proceeds, returning -EINVAL otherwise.

Doyensec's part 3 writeup (following a two-part fuzzing series: part 1 used an extended syzkaller SMB2 grammar with patched auth bypass to find CVE-2024-50283/50285/50286, and part 2 added grammar-based SMB2 fuzzing, syzkaller focus_areas targeting of ksmbd functions such as smb_check_perm_dacl, and Wireshark-capture-derived corpus seeding to find 23 bugs across 22 CVEs including this one) turns the raw OOB write into full root code execution in five stages. Stage 1 (heap grooming): the exploit sprays 1024 msg_msg kernel objects (4096 bytes each, via msgget()/msgsnd()/msgctl() System V IPC syscalls) into the kmalloc-cg-4k slab cache to exhaust order-3/order-4 buddy-allocator freelists and force the allocator to split order-5 blocks, positioning the eventual kvzalloc(0x10000) stream_buf allocation adjacent to a victim msg_msg object. Stage 2 (UAF setup): the OOB write corrupts the 'next' pointer of an adjacent primary msg_msg structure, producing pointer aliasing between two primary messages and a shared secondary message; the exploit tags messages with queue indices and uses msgrcv(MSG_COPY) to non-destructively scan and identify the corrupted pair via mismatched tags, then frees the secondary message to create a genuine use-after-free. Stage 3 (info leak/SMAP bypass): UNIX-domain-socket sk_buff objects (via socket()/sendmsg()/recvmsg()) are sprayed to reclaim the freed slot with a crafted msg_msg carrying an inflated m_ts field; reading it back via copy_msg() returns excess data — a page-level rather than slab-level corruption that bypasses SMAP — leaking adjacent kernel heap pointers (mlist.next/mlist.prev), and a second sk_buff spray rebuilds the msg_msg's list pointers so it can be safely freed. Stage 4 (KASLR bypass): pipe_buffer objects are allocated over the freed UAF slot to leak the anon_pipe_buf_ops function pointer; the author's run computed kbase_addr ffffffffa2000000 with a kslide of 0x21000000 from that leak. Stage 5 (code execution): a third sk_buff spray forges a pipe_buf_operations structure whose release callback points into a ROP chain; closing the pipe triggers the callback, stack-pivots, and runs the ROP chain to gain arbitrary kernel code execution, confirmed in the writeup by `# id` returning `uid=0(root) gid=0(root) groups=0(root))`.

The author states the exploitation methodology for the msg_msg/UAF primitive (internally referred to in the writeup as the "writeleak" primitive for the information-disclosure step) is directly inspired by the public CVE-2021-22555 (Linux netfilter, exploited historically for a Chrome-sandbox-adjacent kernel escape) exploitation approach and corCTF 2021 msg_msg UAF techniques; Retbleed-style side-channel leaks were considered and explicitly rejected by the author as an alternative info-leak path. The exploit authenticates to the target ksmbd share using the libsmb2 open-source SMB2/3 client library, and during development the author used GDB breakpoints and the bundled eBPF tracer to confirm heap object addresses were properly page-aligned before finalizing the grooming parameters; all kernel structure/function offsets in the published exploit are hardcoded for the single tested build (Ubuntu 22.04.5 LTS, kernel 5.15.0-153-generic) rather than resolved dynamically, so the public PoC does not self-adapt to other kernel builds without offset changes. Development artifacts (documented in the doyensec/KSMBD-CVE-2025-37947 GitHub repository) include CVE-2025-37947.c (full exploit), proof-of-concept.c (minimal OOB-write trigger), bpf-tracer.sh (an eBPF msg_msg tracer used to validate heap-grooming/allocation state during development), ksmbd.conf (sample vulnerable share config enabling streams_xattr), a Makefile, and run-qemu.sh (launches a local Ubuntu 22.04.5 QEMU VM for testing, requiring a pre-built ubuntu-22.04.5.qcow2 image). The PoC is probabilistic (~90% success observed by the author), with the remaining ~10% of runs producing uncontrolled object overwrites or outright kernel panics rather than a clean root shell.

The same Doyensec ksmbd research series separately documents CVE-2025-22041, a double-free in ksmbd_free_user() in the ksmbd authentication/session-teardown path; the part-3 writeup references it as related prior work from the same fuzzing effort, though it is a distinct vulnerability from CVE-2025-37947 and is not itself the subject of this record.

Exploitation requires an authenticated local SMB user account with write access to a share that has the streams_xattr VFS module enabled, consistent with the CVSS 3.1 vector's Attack Vector: Local (AV:L) and Privileges Required: Low (PR:L) — this is a local privilege-escalation primitive, not a remote/unauthenticated attack against the SMB service itself. No public evidence of in-the-wild exploitation exists at the time of this writeup; the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the most recent KEV catalog additions reviewed. The affected code path spans multiple upstream kernel release lines and dozens of downstream distribution kernel packages (Ubuntu — including the 22.04 LTS jammy family and the 20.04 LTS focal HWE-5.15 kernel variants (linux-hwe-5.15, linux-aws-5.15, linux-azure-5.15, linux-gcp-5.15, linux-ibm-5.15, linux-intel-iotg-5.15, linux-lowlatency-hwe-5.15, linux-nvidia-tegra-5.15, linux-oracle-5.15, linux-riscv-5.15; base focal linux and 18.04 bionic and earlier are NOT affected — ksmbd was introduced later), Debian, and others), most of which had patches available within the same 2025 disclosure window.