CVE-2025-38208

What it actually does

Missing NULL pointer validation in smb client automount_fullpath when tcon->origin_fullpath is set allows dereference of a null page from __build_path_from_dentry_optional_prefix, resulting in kernel memory corruption.

Why it matters to the business

Linux systems using SMB automounts face risk of kernel crashes or local privilege escalation, potentially disrupting containerized services and requiring urgent patching across many deployments despite low exploitation probability.

How an attack unfolds

An attacker with local access crafts conditions to trigger SMB automount with origin_fullpath populated but a null page allocation, dereferencing the pointer to corrupt kernel memory; listed threat actors have demonstrated similar Linux kernel privilege escalation techniques in container environments.

How to fix it

Apply kernel patch 37166d63e42c34846a16001950ecec96229a8d17 or upgrade affected packages to fixed versions: thingsboard and related components to 4.0.1-r8 on both Chainguard and Wolfi; rebuild and redeploy containers after update.

How to confirm the fix worked

Verify running kernel contains commit 37166d63e42c34846a16001950ecec96229a8d17; confirm package versions match 4.0.1-r8 for thingsboard components; test automount operations under origin_fullpath conditions to ensure no dereference occurs.

Typical attack path

1. Obtain local code execution on a Linux host or container using SMB client automount
2. Trigger automount operation where tcon->origin_fullpath is already set
3. Force the code path that skips the existing NULL check in __build_path_from_dentry_optional_prefix
4. Cause null page dereference leading to crash or memory corruption for escalation

How to detect it

Review kernel logs for NULL pointer dereference oops traces involving smb or cifs automount paths; correlate with process activity creating SMB mounts where origin_fullpath may be populated; examine container runtime logs for unexpected SMB client crashes in listed threat actor campaigns.

What your security team should do

• Prioritize patching Linux kernel and thingsboard containers to listed fixed versions within 30 days given publication age and listed escalation actors
• Audit environments for SMB automount usage and restrict to least-privilege mounts
• Monitor EPSS trend and re-evaluate if score rises above 0.01