CVE-2025-38092: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38092 is a NULL pointer dereference vulnerability in the Linux kernel's ksmbd (kernel SMB server) component, caused by improper use of the list_first_entry() macro in the opinfo_get_list() function. The macro never returns NULL when a list is empty — instead it returns an invalid pointer — which can lead to system instability or denial of service. The vulnerability was published on July 2, 2025, and affects Linux kernel versions 6.6.88–6.6.93, 6.12.25–6.12.32, 6.14.4–6.14.10, and 6.15 release candidates (rc3–rc7). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In the ksmbd subsystem, the opinfo_get_list() function used list_first_entry() to retrieve the first element of an oplock information list; however, this macro does not perform an emptiness check and returns an invalid (non-NULL) pointer when the list is empty, leading to a subsequent dereference of an invalid memory address. The fix replaces the call with list_first_entry_or_null(), which correctly returns NULL for empty lists, allowing callers to handle the empty-list condition safely. Exploitation requires local access with low privileges, as an attacker would need to trigger the code path where the oplock list is empty during SMB server operation (Red Hat Bugzilla, Feedly).

Successful exploitation of this vulnerability can cause system instability or a kernel panic, resulting in a denial of service (DoS) on the affected host. The impact is limited to availability — there is no confidentiality or integrity impact — and the scope is confined to the local system running the ksmbd SMB server. Lateral movement or data exfiltration are not directly enabled by this vulnerability (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface (Feedly).

The fix has been backported to stable kernel versions 6.6.93, 6.12.32, and 6.14.10, as well as the mainline 6.15 release. Administrators should update to one of these patched versions as the primary remediation. As a secondary measure, restricting local system access and disabling the ksmbd module if SMB server functionality is not required can reduce exposure. Ubuntu has issued security notices USN-7769-1, USN-7769-2, USN-7771-1, and USN-7789-1 addressing this vulnerability (Red Hat Bugzilla, Ubuntu USN-7769-1, Ubuntu USN-7789-1).