CVE-2025-38092

What it actually does

Incorrect use of list_first_entry() on a potentially empty oplock info list in ksmbd returns an invalid pointer instead of NULL, enabling subsequent dereference that corrupts kernel memory.

Why it matters to the business

Kernel memory corruption in the SMB server can cause system crashes, data corruption, or remote code execution on file servers, forcing unplanned downtime and recovery across Linux deployments that expose SMB shares.

How an attack unfolds

An attacker sends specially crafted SMB requests that trigger the opinfo_get_list path when the list is empty; the invalid pointer is dereferenced, corrupting kernel structures and potentially leading to arbitrary code execution or denial of service.

How to fix it

Upgrade the Linux kernel to version 6.6.93 or later, or apply the commit c78abb646ff823e7d22faad4cc0703d4484da9e8. Rebuild and reboot affected systems; for Mageia 8 apply qtwebengine5 update 5.15.5-1.mga8 if applicable.

How to confirm the fix worked

Verify the running kernel contains commit c78abb646ff823e7d22faad4cc0703d4484da9e8 or is at least version 6.6.93; inspect source for list_first_entry_or_null() in opinfo_get_list(); confirm no crash under load after upgrade.

Typical attack path

1. Establish SMB session to target ksmbd server
2. Send sequence of SMB2 negotiate and session setup packets
3. Issue oplock or lease requests that empty the internal list
4. Trigger opinfo_get_list() dereference of invalid pointer
5. Exploit resulting memory corruption for code execution or crash

How to detect it

Search kernel logs for ksmbd-related oops, invalid pointer dereference, or list corruption messages; inspect SMB traffic for unusual oplock/lease request patterns preceding crashes; review audit logs for unexpected ksmbd process terminations.

What your security team should do

• Immediately upgrade all Linux kernels exposing ksmbd to 6.6.93 or newer
• Disable ksmbd if SMB server functionality is not required
• Monitor kernel logs for oops or panic messages related to ksmbd oplock handling
• Apply vendor backports within the CISA remediation window if applicable