CVE-2025-39838

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-39838
In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1f797f062b5cf13a1c2bcc23285361baaa7c9260 Patch
https://git.kernel.org/stable/c/3c26a8d30ed6b53a52a023ec537dc50a6d34a67a Patch
https://git.kernel.org/stable/c/70bccd9855dae56942f2b18a08ba137bb54093a0 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

23 Jan 2026, 02:34

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/1f797f062b5cf13a1c2bcc23285361baaa7c9260 - () https://git.kernel.org/stable/c/1f797f062b5cf13a1c2bcc23285361baaa7c9260 - Patch
References () https://git.kernel.org/stable/c/3c26a8d30ed6b53a52a023ec537dc50a6d34a67a - () https://git.kernel.org/stable/c/3c26a8d30ed6b53a52a023ec537dc50a6d34a67a - Patch
References () https://git.kernel.org/stable/c/70bccd9855dae56942f2b18a08ba137bb54093a0 - () https://git.kernel.org/stable/c/70bccd9855dae56942f2b18a08ba137bb54093a0 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory

02 Jan 2026, 16:16

Type Values Removed Values Added
References
  • {'url': 'https://git.kernel.org/stable/c/1cfa5dd05847137f0fb3ce74ced80c0b4858d716', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://git.kernel.org/stable/c/65b98a7e65e7a8f3894d8760cd194eaf20504c99', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

19 Sep 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-19 16:15

Updated : 2026-01-23 02:34

NVD link : CVE-2025-39838

Mitre link : CVE-2025-39838

CVE.ORG link : CVE-2025-39838

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference