NetSight
IP …
medium5.5

CVE-2025-39838

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dere…

Impact

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 6.12 before 6.12.46
from 6.13 before 6.16.6
Version 6.17
DebianDebian Linux
Version 11.0

Weakness classification

CWE-476

References