VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 4, 2025· Updated Jul 30, 2026

CVE-2025-38191

CVE-2025-38191

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix null pointer dereference in destroy_previous_session

If client set ->PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess->user is not set yet, It can pass the user argument as NULL to destroy_previous_session. sess->user will be set in ksmbd_krb5_authenticate(). So this patch move calling destroy_previous_session() after ksmbd_krb5_authenticate().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • osv-coords
    pkg:linux/kernel
    Range: >= 5.15.0, < 6.1.142
  • Linux/Kernelcpe-rescue5 versions
    5.15+ 4 more
    • (no CPE)range: 5.15
    • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=5.15,<6.1.142
    • cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
    • (no CPE)
  • Debian/linux
    cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.