CVE-2025-38092: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was identified in the Linux kernel's ksmbd component, tracked as CVE-2025-38092. The issue was discovered and disclosed on July 2, 2025, involving the improper use of the list_first_entry() macro in the opinfo_get_list() function (NVD).

The vulnerability stems from the list_first_entry() macro implementation in the ksmbd component, which never returns NULL. When the list is empty, it returns an invalid pointer instead of properly handling the empty list condition. The correct implementation should use list_first_entry_or_null() to properly check if the list is empty (CVE).

The vulnerability affects multiple Linux distributions and their kernel packages, including Ubuntu's various releases (noble, jammy, focal) and their associated kernel variants (aws, azure, gcp). This impacts both standard and specialized kernel packages such as lowlatency, nvidia, and cloud provider-specific kernels (Ubuntu).

The vulnerability has been resolved in several Linux distributions. Debian has fixed the issue in various releases: bullseye (5.10.223-1), trixie (6.12.35-1), and sid (6.12.37-1). However, some versions remain vulnerable, such as bookworm (6.1.137-1) (Debian).