CVE-2025-38191

ksmbd: fix null pointer dereference in destroy_previous_session

published July 4, 2025

CVSS
—
EPSS
1%
Percentile
72.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix null pointer dereference in destroy_previous_session

If client set ->PreviousSessionId on kerberos session setup stage,

NULL pointer dereference error will happen. Since sess->user is not

set yet, It can pass the user argument as NULL to destroy_previous_session.

sess->user will be set in ksmbd_krb5_authenticate(). So this patch move

calling destroy_previous_session() after ksmbd_krb5_authenticate().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01423 · 72.7th percentile
Published
2025-07-04T13:37Z
EPSS history
Timeline
  • 04 JUL 13:37Z
    ksmbd: fix null pointer dereference in destroy_previous_session
    cvelistv5