#VU108863 NULL pointer dereference in Linux kernel - CVE-2025-37844
Published: May 9, 2025 / Updated: May 10, 2025
Vulnerability identifier: #VU108863
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-37844
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the smb2_handle_cancelled_close() function in fs/smb/client/smb2misc.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
External links
- https://git.kernel.org/stable/c/20048e658652e731f5cadf4a695925e570ca0ff9
- https://git.kernel.org/stable/c/6c14ee6af8f1f188b668afd6d003f7516a507b08
- https://git.kernel.org/stable/c/864ba5c651b03830f36f0906c21af05b15c1aaa6
- https://git.kernel.org/stable/c/9c9000cb91b986eb7f75835340c67857ab97c09b
- https://git.kernel.org/stable/c/b2a1833e1c63e2585867ebeaf4dd41494dcede4b
- https://git.kernel.org/stable/c/b4885bd5935bb26f0a414ad55679a372e53f9b9b
- https://git.kernel.org/stable/c/ba3ce6c60cd5db258687dfeba9fc608f5e7cadf3
- https://git.kernel.org/stable/c/e0717385f5c51e290c2cd2ad4699a778316b5132
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.24