What’s Vulnerable › Vulnerabilities

CVE-2025-38092: ksmbd: use list_first_entry_or_null for opinfo_get_list()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-02 · updated 2026-07-30
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use list_first_entry_or_null for opinfo_get_list() The list_first_entry() macro never returns NULL. If the list is empty then it returns an invalid pointer. Use list_first_entry_or_null() to check if the list is empty.

Affected products

• Linux kernel: from 6.6.88 before 6.6.93; from 6.12.25 before 6.12.32; from 6.14.4 before 6.14.10; 6.15-rc3, 6.15-rc4, 6.15-rc5, 6.15-rc6, 6.15-rc7 — fixed in 6.12.32, 6.14.10, 6.6.93

How to fix

Upgrade to a fixed version: Linux kernel 6.12.32, 6.14.10, 6.6.93. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/10379171f346e6f61d30d9949500a8de4336444a
• https://git.kernel.org/stable/c/334da674b25fdb7a1a4d4b89dcd7795144fc7e11
• https://git.kernel.org/stable/c/c78abb646ff823e7d22faad4cc0703d4484da9e8
• https://git.kernel.org/stable/c/cb7e06e9736d73007dc8dab7b353733bb37df86b

Get alerted when CVE-2025-38092 or the next vulnerability affects your stack