GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38092 (GCVE-0-2025-38092)

Vulnerability from cvelistv5 – Published: 2025-07-02 14:43 – Updated: 2026-08-05 11:59
VLAI
Title
ksmbd: use list_first_entry_or_null for opinfo_get_list()
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use list_first_entry_or_null for opinfo_get_list() The list_first_entry() macro never returns NULL. If the list is empty then it returns an invalid pointer. Use list_first_entry_or_null() to check if the list is empty.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 296cb5457cc6f4a754c4ae29855f8a253d52bcc6 , < c78abb646ff823e7d22faad4cc0703d4484da9e8 (git)
Affected: d54ab1520d43e95f9b2e22d7a05fc9614192e5a5 , < 334da674b25fdb7a1a4d4b89dcd7795144fc7e11 (git)
Affected: d73686367ad68534257cd88a36ca3c52cb8b81d8 , < cb7e06e9736d73007dc8dab7b353733bb37df86b (git)
Affected: 18b4fac5ef17f77fed9417d22210ceafd6525fc7 , < 10379171f346e6f61d30d9949500a8de4336444a (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6.88 , < 6.6.93 (semver)
Affected: 6.12.25 , < 6.12.32 (semver)
Affected: 6.14.4 , < 6.14.10 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/oplock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c78abb646ff823e7d22faad4cc0703d4484da9e8",
              "status": "affected",
              "version": "296cb5457cc6f4a754c4ae29855f8a253d52bcc6",
              "versionType": "git"
            },
            {
              "lessThan": "334da674b25fdb7a1a4d4b89dcd7795144fc7e11",
              "status": "affected",
              "version": "d54ab1520d43e95f9b2e22d7a05fc9614192e5a5",
              "versionType": "git"
            },
            {
              "lessThan": "cb7e06e9736d73007dc8dab7b353733bb37df86b",
              "status": "affected",
              "version": "d73686367ad68534257cd88a36ca3c52cb8b81d8",
              "versionType": "git"
            },
            {
              "lessThan": "10379171f346e6f61d30d9949500a8de4336444a",
              "status": "affected",
              "version": "18b4fac5ef17f77fed9417d22210ceafd6525fc7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/oplock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.93",
              "status": "affected",
              "version": "6.6.88",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.32",
              "status": "affected",
              "version": "6.12.25",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14.10",
              "status": "affected",
              "version": "6.14.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.93",
                  "versionStartIncluding": "6.6.88",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.32",
                  "versionStartIncluding": "6.12.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.10",
                  "versionStartIncluding": "6.14.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use list_first_entry_or_null for opinfo_get_list()\n\nThe list_first_entry() macro never returns NULL.  If the list is\nempty then it returns an invalid pointer.  Use list_first_entry_or_null()\nto check if the list is empty."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server; the vulnerable path is driven entirely by remote SMB2 CREATE, LOCK and CLOSE requests arriving on TCP/445 from a remote client. No local access is required.\nAC:L - The attacker controls both sides of the race by issuing concurrent SMB2 CREATE/LOCK and CLOSE requests on multiple connections against the same file, and the window is actively widened because down_read() in opinfo_get_list() blocks behind the racing opinfo_del() down_write() that empties the list.\nPR:L - Reaching smb_grant_oplock()/smb_break_all_oplock() requires an established SMB2 session, a tree connect and open file handles, so a valid (even low-privilege or guest-mapped) SMB account is needed; this is not a pre-authentication code path.\nUI:N - The attacker drives every step from its own SMB connections \u2014 opening handles with oplocks/leases and closing them concurrently. No action by any other user or administrator is needed.\nS:U - The type confusion corrupts kernel heap memory belonging to the ksmbd subsystem within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The fake oplock_info causes reads through attacker-timed wild pointers \u2014 opinfo-\u003econn resolves to an rwsem waiter on another task\u0027s kernel stack and o_lease to an arbitrary kernel pointer \u2014 and such heap type confusion is leverageable into arbitrary kernel memory disclosure.\nI:H - atomic_inc_not_zero() performs a real RMW write onto the upper half of ksmbd_inode-\u003em_hash.pprev, corrupting a kernel pointer that hlist_del_init() later writes through, and follow-on oplock_break()/opinfo_put() paths add out-of-bounds wait-queue list writes and kfree() of interior pointers \u2014 classic type confusion promotable to a write primitive.\nA:H - Dereferencing and atomically modifying a bogus pointer derived from the list head, plus spinlock/wait-queue operations past the end of the kmalloc\u0027d ksmbd_inode, reliably produce slab corruption, oops or panic, taking down the file server host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:27.724Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c78abb646ff823e7d22faad4cc0703d4484da9e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/334da674b25fdb7a1a4d4b89dcd7795144fc7e11"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb7e06e9736d73007dc8dab7b353733bb37df86b"
        },
        {
          "url": "https://git.kernel.org/stable/c/10379171f346e6f61d30d9949500a8de4336444a"
        }
      ],
      "title": "ksmbd: use list_first_entry_or_null for opinfo_get_list()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38092",
    "datePublished": "2025-07-02T14:43:30.776Z",
    "dateReserved": "2025-04-16T04:51:23.983Z",
    "dateUpdated": "2026-08-05T11:59:27.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38092",
      "date": "2026-09-19",
      "epss": "0.00293",
      "percentile": "0.22136"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:26:21.000Z",
      "cve": "CVE-2025-38092",
      "id": "msrc_CVE-2025-38092",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: use list_first_entry_or_null for opinfo_get_list()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38092.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/oplock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c78abb646ff823e7d22faad4cc0703d4484da9e8",
                    "status": "affected",
                    "version": "296cb5457cc6f4a754c4ae29855f8a253d52bcc6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "334da674b25fdb7a1a4d4b89dcd7795144fc7e11",
                    "status": "affected",
                    "version": "d54ab1520d43e95f9b2e22d7a05fc9614192e5a5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cb7e06e9736d73007dc8dab7b353733bb37df86b",
                    "status": "affected",
                    "version": "d73686367ad68534257cd88a36ca3c52cb8b81d8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "10379171f346e6f61d30d9949500a8de4336444a",
                    "status": "affected",
                    "version": "18b4fac5ef17f77fed9417d22210ceafd6525fc7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/oplock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6.6.93",
                    "status": "affected",
                    "version": "6.6.88",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.32",
                    "status": "affected",
                    "version": "6.12.25",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.14.10",
                    "status": "affected",
                    "version": "6.14.4",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F54AB024-7562-4452-93AE-645798E55BC9",
                    "versionEndExcluding": "6.6.93",
                    "versionStartIncluding": "6.6.88",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "832CC9EC-F0C4-4B47-9980-86D9414763B6",
                    "versionEndExcluding": "6.12.32",
                    "versionStartIncluding": "6.12.25",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B5929498-4B70-40E7-98F4-40F6F0D68158",
                    "versionEndExcluding": "6.14.10",
                    "versionStartIncluding": "6.14.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "C300BA32-5854-4B59-A00A-18A402F291D0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use list_first_entry_or_null for opinfo_get_list()\n\nThe list_first_entry() macro never returns NULL.  If the list is\nempty then it returns an invalid pointer.  Use list_first_entry_or_null()\nto check if the list is empty."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: usar list_first_entry_or_null para opinfo_get_list(). La macro list_first_entry() nunca devuelve NULL. Si la lista est\u00e1 vac\u00eda, devuelve un puntero no v\u00e1lido. Use list_first_entry_or_null() para comprobar si la lista est\u00e1 vac\u00eda."
          }
        ],
        "id": "CVE-2025-38092",
        "lastModified": "2026-07-30T06:22:50.317",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-02T15:15:26.197",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/10379171f346e6f61d30d9949500a8de4336444a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/334da674b25fdb7a1a4d4b89dcd7795144fc7e11"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c78abb646ff823e7d22faad4cc0703d4484da9e8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cb7e06e9736d73007dc8dab7b353733bb37df86b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:21:59+00:00",
      "cve": "CVE-2025-38092",
      "id": "CVE-2025-38092",
      "initial_release_date": "2025-07-02T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: use list_first_entry_or_null for opinfo_get_list()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38092.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T17:02:49Z",
      "cve": "CVE-2025-38092",
      "id": "CVE-2025-38092",
      "initial_release_date": "2025-07-02T23:21:50Z",
      "product_status:known_not_affected": "524",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38092",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38092.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.