CVE-2025-38092
BaseFortify
Publication date: 2025-07-02
Last updated on: 2025-11-20
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves improper use of the list_first_entry() macro in the ksmbd component. The macro list_first_entry() never returns NULL and returns an invalid pointer if the list is empty, which can lead to errors. The fix was to use list_first_entry_or_null() instead, which properly checks if the list is empty before accessing it.
How can this vulnerability impact me? :
If exploited, this vulnerability could cause the Linux kernel to access invalid memory pointers, potentially leading to system instability, crashes, or unexpected behavior in the ksmbd service.