n the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE
Configuration 1 (hide)
|
Configuration 2 (hide)
|
23 Jan 2026, 02:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/1f797f062b5cf13a1c2bcc23285361baaa7c9260 - Patch | |
| References | () https://git.kernel.org/stable/c/3c26a8d30ed6b53a52a023ec537dc50a6d34a67a - Patch | |
| References | () https://git.kernel.org/stable/c/70bccd9855dae56942f2b18a08ba137bb54093a0 - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory | |
| CWE | CWE-476 | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Debian
Linux linux Kernel Linux Debian debian Linux |
02 Jan 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Nov 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 Sep 2025, 21:23
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Published : 2025-09-19 16:15
Updated : 2026-01-23 02:34
NVD link : CVE-2025-39838
Mitre link : CVE-2025-39838
CVE.ORG link : CVE-2025-39838
JSON object : View
NULL Pointer Dereference