---
id: CVE-2025-39838
title: 'cifs: prevent NULL pointer dereference in UTF16 conversion'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cifs: prevent NULL pointer dereference in UTF16 conversion

  There can be a NULL pointer dereference bug here. NULL is passed to
  __cifs_sfu_make_node without checks, whi…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 <
    1f797f062b5cf13a1c2bcc23285361baaa7c9260
  - >-
    Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 <
    3c26a8d30ed6b53a52a023ec537dc50a6d34a67a
  - >-
    Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 <
    70bccd9855dae56942f2b18a08ba137bb54093a0
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:12:29.483732Z'
published: '2025-09-19'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:59.903Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39838'
references:
  - url: 'https://git.kernel.org/stable/c/1f797f062b5cf13a1c2bcc23285361baaa7c9260'
  - url: 'https://git.kernel.org/stable/c/3c26a8d30ed6b53a52a023ec537dc50a6d34a67a'
  - url: 'https://git.kernel.org/stable/c/70bccd9855dae56942f2b18a08ba137bb54093a0'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05247
ingestedAt: '2026-11-05T22:38:32.032Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cifs: prevent NULL pointer dereference in UTF16 conversion

There can be a NULL pointer dereference bug here. NULL is passed to
__cifs_sfu_make_node without checks, which passes it unchecked to
cifs_strndup_to_utf16, which in turn passes it to
cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash.

This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and
returns NULL early to prevent dereferencing NULL pointer.

Found by Linux Verification Center (linuxtesting.org) with SVACE

## Affected

- `Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 < 1f797f062b5cf13a1c2bcc23285361baaa7c9260`
- `Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 < 3c26a8d30ed6b53a52a023ec537dc50a6d34a67a`
- `Linux >= 41d3f256c6a5e41eb32b87168399c0facd512dc0 < 70bccd9855dae56942f2b18a08ba137bb54093a0`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.