Potential NULL Pointer Dereference in Linux Kernel - linux Package Vulnerability
Summary
DEBIAN-CVE-2025-38208: In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automount_fullpath page is checked for null in __build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for enabling the execution of applications and managing system processes. Given its foundational role, vulnerabilities in the linux package can have widespread implications for system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of NULL pointers in the SMB client functionality. Specifically, the function __build_path_from_dentry_optional_prefix lacks a NULL check when tcon->origin_fullpath is set, potentially leading to a NULL pointer dereference. This oversight could allow an attacker to exploit the vulnerability, resulting in system crashes or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been recommended for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate potential risks.
Conclusion
The identified vulnerability in the linux package of the Linux kernel poses a significant risk due to the potential for NULL pointer dereference. Users are urged to update to the patched version 6.12.35-1 to mitigate this risk. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a potential NULL pointer dereference in the SMB client functionality of the Linux kernel.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Failure to address this vulnerability may lead to system crashes or unauthorized access to sensitive data, compromising system integrity and security.
Yes, the vulnerability is fixed in version 6.12.35-1 of the linux package.
It is recommended to check for updates regularly, ideally on a weekly basis, to ensure that your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
