CVE-2025-38191

What it actually does

Null pointer dereference in ksmbd destroy_previous_session when PreviousSessionId is supplied during Kerberos session setup before sess->user is initialized in ksmbd_krb5_authenticate.

Why it matters to the business

Linux systems running ksmbd may crash during SMB authentication attempts, causing denial of service for file sharing services; high prevalence in container images amplifies operational risk across deployments.

How an attack unfolds

An attacker initiates a Kerberos-authenticated SMB session setup supplying a PreviousSessionId value; because authentication has not yet populated sess->user, the call to destroy_previous_session passes NULL and triggers the dereference, leading to a kernel panic or potential further memory corruption.

How to fix it

Upgrade the Linux kernel to a version containing commit 281afc52e2961cd5dd8326ebc9c5bc40904c0468 or later; for affected container packages apply the listed fixed versions such as 25.6.2-r0 for linkerd2 variants.

How to confirm the fix worked

Confirm the patch is present by checking kernel source for the reordered ksmbd_krb5_authenticate call before destroy_previous_session, or verify package versions match the fixed releases provided.

Typical attack path

1. Connect to ksmbd and begin SMB2 session setup using Kerberos
2. Include a non-zero PreviousSessionId field before authentication completes
3. Trigger the premature destroy_previous_session call resulting in NULL dereference

How to detect it

Review kernel logs for oops or panic messages referencing destroy_previous_session or ksmbd during SMB session setup; correlate with network traffic showing Kerberos-authenticated session requests containing PreviousSessionId.

What your security team should do

• Prioritize kernel and package upgrades on all systems exposing ksmbd
• Monitor EPSS trend and threat actor activity for any increase in targeting
• Temporarily disable ksmbd or restrict SMB access if immediate patching is not feasible