Medium severity5.5NVD Advisory· Published Aug 19, 2025· Updated Apr 18, 2026

CVE-2025-38562

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix null pointer dereference error in generate_encryptionkey

If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generate_encryptionkey could happen. sess->Preauth_HashValue is set to NULL if session is valid. So this patch skip generate encryption key if session is valid.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Debian/linux
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Linux/Kernel2 versions
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=5.15,<6.1.148
- (no CPE)

Patches

Vulnerability mechanics

References

git.kernel.org/stable/c/015ef163d65496ae3ba6192c96140a22743f0353nvdPatch
git.kernel.org/stable/c/2a30ed6428ce83afedca1a6c5c5c4247bcf12d0envdPatch
git.kernel.org/stable/c/96a82e19434a2522525baab59c33332658bc7653nvdPatch
git.kernel.org/stable/c/9b493ab6f35178afd8d619800df9071992f715denvdPatch
git.kernel.org/stable/c/9c2dbbc959e1fcc6f603a1a843e9cf743ba383bbnvdPatch
git.kernel.org/stable/c/d79c8bebaa622ee223128be7c66d8aaeeb634a57nvdPatch
lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlnvdMailing ListThird Party Advisory
www.zerodayinitiative.com/advisories/ZDI-25-917/nvdMailing ListThird Party Advisory
git.kernel.org/stable/c/922f85e6e88fdea723a26854c3a6dcb4beb8d0b9nvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.006
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000