Null Pointer Dereference Vulnerability in Linux Kernel for ksmbd Product by Linux Foundation

CVE-2025-38191

What is CVE-2025-38191?

A null pointer dereference vulnerability exists within the ksmbd component of the Linux kernel. When a client sets the PreviousSessionId during the Kerberos session setup, this can lead to a NULL pointer dereference. This error occurs because the user parameter remains unset, allowing a null value to be passed to the destroy_previous_session function. The issue is resolved by ensuring that the destroy_previous_session is invoked only after the user has been authenticated through the ksmbd_krb5_authenticate function, thus preventing the potential for system instability.

References