Null Pointer Dereference Vulnerability in Linux Kernel (CVE-2025-38191)
Summary
CVE-2025-38191: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroy_previous_session If client set ->PreviousSessionId on kerberos session setup stage, NULL pointer derefere... Affects linux versions < 6.1.147-1. Fixed in 6.1.147-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities. CVE-2025-38191 affects the ksmbd component of the Linux kernel, which is responsible for SMB (Server Message Block) protocol support, particularly in handling Kerberos authentication.
Vulnerability Detail
CVE-2025-38191 is a null pointer dereference vulnerability that occurs during the Kerberos session setup stage in ksmbd. If a client sets the ->PreviousSessionId, it can lead to a NULL pointer dereference error because the session's user is not yet established. This can potentially crash the service or lead to denial of service, as the function destroy_previous_session is called with a NULL user argument before it is properly initialized.
How To Fix
Minimum fixed version
6.1.147-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to prevent potential exploitation.
Conclusion
CVE-2025-38191 is a critical vulnerability in the Linux kernel that can lead to service disruptions due to null pointer dereference. Users are advised to update their systems promptly to the latest patched version of the Linux package to ensure security and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38191 is a vulnerability in the Linux kernel that can lead to a null pointer dereference during Kerberos session setup in ksmbd.
This vulnerability can cause a denial of service by crashing the ksmbd service, affecting SMB protocol operations.
If you are using Debian 11, 12, or 13 with the Linux kernel, your system may be affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
