CVE-2025-38562 ksmbd: fix null pointer dereference error in generate_encryptionkey
A null pointer dereference in the Linux kernel ksmbd module allows remote attackers to cause a denial of service via crafted session setup requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38562?
CVE-2025-38562 is a medium-severity vulnerability in Debian Debian Linux, published on 19 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference error in generate_encryptionkey
If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generate_encryptionkey could happen. sess->Preauth_HashValue is set to NULL if session is valid. So this patch skip generate encryption key if session is valid.
Weakness: CWE-476
Which versions are affected by CVE-2025-38562?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38562?
Apply the vendor's patch.
Is CVE-2025-38562 being exploited?
There is no known exploitation of CVE-2025-38562 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-66458, BELL-CVE-2025-38562, DEBIAN-CVE-2025-38562, GHSA-3qv5-2654-5g25, ROOT-OS-DEBIAN-11-CVE-2025-38562, ROOT-OS-DEBIAN-12-CVE-2025-38562 and 4 more.