CVE-2025-39838

What it actually does

NULL pointer dereference in cifs_strndup_to_utf16 when a NULL src buffer is passed from __cifs_sfu_make_node through cifs_local_to_utf16_bytes, causing kernel crash.

Why it matters to the business

Local denial-of-service on Linux systems using CIFS/SMB shares, potentially disrupting file access and requiring reboots; widespread in kernel-dependent environments with moderate downstream impact.

How an attack unfolds

An attacker with local access crafts input that reaches __cifs_sfu_make_node without a valid source buffer, triggering the unchecked path through cifs_strndup_to_utf16 and dereferencing NULL in the UTF-16 length calculation; listed threat actors such as VMSCAPE and container privilege-escalation campaigns have targeted similar kernel paths.

How to fix it

Update the Linux kernel to the fixed commit 1f797f062b5cf13a1c2bcc23285361baaa7c9260 or later stable releases that include the NULL check in cifs_strndup_to_utf16.

How to confirm the fix worked

Verify the presence of the NULL check for src in cifs_strndup_to_utf16 in the running kernel source or confirm kernel version contains commit 1f797f062b5cf13a1c2bcc23285361baaa7c9260.

Typical attack path

1. Obtain local user access on a Linux system with CIFS enabled
2. Trigger CIFS node creation or SFU-related code paths that pass NULL to __cifs_sfu_make_node
3. Reach cifs_strndup_to_utf16 without NULL check
4. Dereference NULL pointer in cifs_local_to_utf16_bytes causing oops/panic

How to detect it

Review kernel logs for oops/panic traces referencing cifs_strndup_to_utf16 or cifs_local_to_utf16_bytes; correlate with CIFS mount activity or SFU node creation attempts by untrusted local users.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all CIFS-enabled systems within the next patch cycle
• Monitor for local privilege or DoS attempts against CIFS code paths
• Review container and VM workloads for similar kernel exposure