Null Pointer Dereference Vulnerability in Linux Kernel's ksmbd Component

CVE-2025-38562

What is CVE-2025-38562?

A null pointer dereference vulnerability exists in the ksmbd component of the Linux kernel, which can be triggered when a client sends two session setups with Kerberos (krb5) authentication. This results in a null pointer reference during the encryption key generation process, potentially allowing for session handling errors. Fortunately, a patch has been implemented to address this issue by ensuring that encryption key generation is skipped for sessions that are deemed valid.

References