NULL Pointer Dereference in Linux Kernel CIFS Component

CVE-2025-39838

What is CVE-2025-39838?

In the Linux kernel, a vulnerability exists in the CIFS (Common Internet File System) component, where a NULL pointer can be dereferenced due to improper checks during UTF16 conversion. The flaw occurs when NULL is passed to the function __cifs_sfu_make_node without appropriate validation. This oversight allows for potential crashes when it reaches the cifs_strndup_to_utf16 function. To resolve this issue, a patch has been implemented that introduces a check for a NULL 'src' parameter, returning early to prevent null pointer dereference and ensuring system stability.

References