CVE-2025-38191

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A null pointer dereference error occurs in the Linux kernel when a client sets the PreviousSessionId during the Kerberos session setup stage. This happens because sess->user is not set yet, allowing a null value to be passed to destroy previous session(). The issue is resolved by moving the call to destroy previous session() after ksmbd krb5 authenticate(), where sess->user is set.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.