CVE-2025-38191 ksmbd: fix null pointer dereference in destroy_previous_session
A null pointer dereference in the Linux kernel's ksmbd module allows a remote attacker to cause a denial of service via a crafted Kerberos session setup.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38191?
CVE-2025-38191 is a high-severity vulnerability in Debian Debian Linux, published on 4 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in destroy_previous_session
If client set ->PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess->user is not set yet, It can pass the user argument as NULL to destroy_previous_session. sess->user will be set in ksmbd_krb5_authenticate(). So this patch move calling destroy_previous_session() after ksmbd_krb5_authenticate().
Weakness: CWE-476
Which versions are affected by CVE-2025-38191?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38191?
Apply the vendor's patch.
Is CVE-2025-38191 being exploited?
There is no known exploitation of CVE-2025-38191 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-64701, BELL-CVE-2025-38191, DEBIAN-CVE-2025-38191, GHSA-f39x-mp5j-46f3, ROOT-OS-DEBIAN-12-CVE-2025-38191, ROOT-OS-UBUNTU-2204-CVE-2025-38191 and 2 more.