{"id":"CVE-2025-39838","title":"cifs: prevent NULL pointer dereference in UTF16 conversion","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent NULL pointer dereference in UTF16 conversion\n\nThere can be a NULL pointer dereference bug here. NULL is passed to\n__cifs_sfu_make_node without checks, whi…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 < 1f797f062b5cf13a1c2bcc23285361baaa7c9260","Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 < 3c26a8d30ed6b53a52a023ec537dc50a6d34a67a","Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 < 70bccd9855dae56942f2b18a08ba137bb54093a0","Linux 6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:12:29.483732Z"},"published":"2025-09-19","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:12:59.903Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39838","references":[{"url":"https://git.kernel.org/stable/c/1f797f062b5cf13a1c2bcc23285361baaa7c9260"},{"url":"https://git.kernel.org/stable/c/3c26a8d30ed6b53a52a023ec537dc50a6d34a67a"},{"url":"https://git.kernel.org/stable/c/70bccd9855dae56942f2b18a08ba137bb54093a0"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.05247,"ingestedAt":"2026-11-05T22:38:32.032Z","slug":"CVE-2025-39838","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent NULL pointer dereference in UTF16 conversion\n\nThere can be a NULL pointer dereference bug here. NULL is passed to\n__cifs_sfu_make_node without checks, which passes it unchecked to\ncifs_strndup_to_utf16, which in turn passes it to\ncifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash.\n\nThis patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and\nreturns NULL early to prevent dereferencing NULL pointer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE\n\n## Affected\n\n- `Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 < 1f797f062b5cf13a1c2bcc23285361baaa7c9260`\n- `Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 < 3c26a8d30ed6b53a52a023ec537dc50a6d34a67a`\n- `Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 < 70bccd9855dae56942f2b18a08ba137bb54093a0`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}