Potential NULL Pointer Dereference in Linux Kernel - SMB Client
Summary
CVE-2025-38208: In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automount_fullpath page is checked for null in __build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is widely used in various distributions, including Debian. The kernel manages system resources, processes, and hardware communication, making it critical for system stability and performance. This vulnerability affects the SMB client functionality, which is responsible for file sharing and network communication, potentially leading to system crashes or data loss.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SMB client where a NULL pointer dereference could occur. This issue arises in the function __build_path_from_dentry_optional_prefix, specifically when the tcon->origin_fullpath is set. The absence of a NULL check in this scenario can lead to unexpected behavior, including system crashes or denial of service. This vulnerability is critical as it can compromise the stability of systems relying on the SMB protocol for file sharing.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2025-38208 vulnerability in the Linux kernel's SMB client poses a significant risk of NULL pointer dereference, which can lead to system instability. Users are encouraged to update their systems promptly to mitigate this risk and ensure continued stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38208 is a vulnerability in the Linux kernel's SMB client that could lead to a NULL pointer dereference, potentially causing system instability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability could lead to system crashes, data loss, or denial of service, affecting the stability of systems that utilize the SMB protocol.
Yes, users should update their Linux kernel to the latest version available in the Debian repositories to address this vulnerability.
While there are no specific workarounds, it is recommended to monitor your system closely and apply the patch as soon as it is available.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
