CVE-2025-38562

ksmbd: fix null pointer dereference error in generate_encryptionkey

published August 19, 2025

CVSS
—
EPSS
12%
Percentile
96.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix null pointer dereference error in generate_encryptionkey

If client send two session setups with krb5 authenticate to ksmbd,

null pointer dereference error in generate_encryptionkey could happen.

sess->Preauth_HashValue is set to NULL if session is valid.

So this patch skip generate encryption key if session is valid.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.11885 · 96.1th percentile
Published
2025-08-19T17:02Z
EPSS history
Timeline
  • 19 AUG 17:02Z
    ksmbd: fix null pointer dereference error in generate_encryptionkey
    cvelistv5