CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion

Q: What is the severity of CVE-2025-39838?

CVE-2025-39838 is classified as a medium severity vulnerability due to the potential for NULL pointer dereference.

Q: How do I fix CVE-2025-39838?

To fix CVE-2025-39838, you should update your Linux kernel to the latest patched version that addresses this vulnerability.

Q: Which versions of the Linux kernel are affected by CVE-2025-39838?

CVE-2025-39838 affects multiple versions of the Linux kernel that have not implemented the fix for this specific vulnerability.

Q: What impact does CVE-2025-39838 have on system functionality?

CVE-2025-39838 may lead to system crashes or instability due to a NULL pointer dereference within the CIFS implementation.

Q: Is CVE-2025-39838 being exploited in the wild?

As of the latest reports, there are no specific instances indicating that CVE-2025-39838 is actively being exploited in the wild.

Published Sep 19, 2025

Updated

cifs: prevent NULL pointer dereference in UTF16 conversion

Affected Software

11 affected componentsFixes available

Linux Linux kernel

Microsoft azl3 kernel 6.6.96.2-2

Microsoft azl3 kernel 6.6.104.2-4

Linux Linux kernel>=6.12<6.12.46

Linux Linux kernel>=6.13<6.16.6

Linux Linux kernel=6.17-rc1

Linux Linux kernel=6.17-rc2

Linux Linux kernel=6.17-rc3

Linux Linux kernel=6.17-rc4

Debian Debian Linux=11.0

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1

Event History

Sep 19, 2025

CVE Published

via MITRE·03:26 PM

Data Sourced

via MITRE·03:26 PM

Description

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Sep 21, 2025

Data Sourced

via Microsoft·01:03 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4328-1

Frequently Asked Questions

What is the severity of CVE-2025-39838?

CVE-2025-39838 is classified as a medium severity vulnerability due to the potential for NULL pointer dereference.

How do I fix CVE-2025-39838?

To fix CVE-2025-39838, you should update your Linux kernel to the latest patched version that addresses this vulnerability.

Which versions of the Linux kernel are affected by CVE-2025-39838?

CVE-2025-39838 affects multiple versions of the Linux kernel that have not implemented the fix for this specific vulnerability.

What impact does CVE-2025-39838 have on system functionality?

CVE-2025-39838 may lead to system crashes or instability due to a NULL pointer dereference within the CIFS implementation.

Is CVE-2025-39838 being exploited in the wild?

As of the latest reports, there are no specific instances indicating that CVE-2025-39838 is actively being exploited in the wild.

CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-39838?

How do I fix CVE-2025-39838?

Which versions of the Linux kernel are affected by CVE-2025-39838?

What impact does CVE-2025-39838 have on system functionality?

Is CVE-2025-39838 being exploited in the wild?

Company

Resources

Contact