CVE-2025-38737

What it actually does

Uninitialised variable in smb3_init_transform_rq() passed to netfs_alloc_folioq_buffer() instead of NULL, causing kernel oops when the CIFS/SMB3 transform request path is exercised.

Why it matters to the business

Linux systems using CIFS/SMB3 network shares can experience sudden kernel crashes, leading to unplanned downtime and potential data loss on affected servers and workstations.

How an attack unfolds

An attacker with the ability to trigger SMB3 transform request handling (for example via crafted mount options or network traffic reaching the cifs module) causes the uninitialised buffer pointer to be dereferenced, resulting in a kernel oops and denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 4931fe2dbe1cc0e7d350a4b51b0b330e43971d98 or later; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Verify the running kernel Git commit or version string includes 4931fe2dbe1cc0e7d350a4b51b0b330e43971d98; attempt to reproduce the original code path and confirm no oops occurs.

Typical attack path

1. Establish or manipulate a CIFS/SMB3 mount that exercises the transform request code path
2. Trigger smb3_init_transform_rq() with conditions that leave the buffer variable uninitialised
3. netfs_alloc_folioq_buffer() receives a non-NULL garbage pointer and performs unsafe operations
4. Kernel oops occurs, crashing the system

How to detect it

Search kernel logs and dmesg output for oops/panic entries referencing cifs, smb3_init_transform_rq, or netfs_alloc_folioq_buffer; correlate with SMB3 mount activity around the time of the crash.

• smb3_init_transform_rq
• netfs_alloc_folioq_buffer
• cifs:.*uninitialised variable
• BUG: unable to handle kernel NULL pointer dereference.*cifs

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all systems using CIFS/SMB3
• Prioritise patching internet-facing or high-value servers that mount remote SMB shares
• Monitor kernel logs for oops messages containing cifs and smb3_init_transform_rq after patching