QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-39838

Back to search

CVE-2025-39838

Published: Sep 19, 2025

Modified: May 12, 2026

PUBLISHED

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE

VendorProductVersions

Linux

Linux

affected
41d3f256c6a5e41eb32b87168399c0facd512dc0 - < 1f797f062b5cf13a1c2bcc23285361baaa7c9260
affected
41d3f256c6a5e41eb32b87168399c0facd512dc0 - < 3c26a8d30ed6b53a52a023ec537dc50a6d34a67a
affected
41d3f256c6a5e41eb32b87168399c0facd512dc0 - < 70bccd9855dae56942f2b18a08ba137bb54093a0

Linux

Linux

affected
6.12
unaffected
0 - < 6.12
unaffected
6.12.46 - <= 6.12.*
unaffected
6.16.6 - <= 6.16.*
unaffected
6.17 - <= *

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now