CVE-2025-38191: Debian Linux

Medium severity, CVSS 5.5. EPSS: 1.4% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroy_previous_session If client set ->PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess->user is not set yet, It can pass the user argument as NULL to destroy_previous_session. sess->user will be set in ksmbd_krb5_authenticate(). So this patch move calling destroy_previous_session() after ksmbd_krb5_authenticate().

Affected products

• Debian Debian Linux: version 11.0 only
• Linux Linux Kernel: from 5.15, before 6.1.142 (fixed in 6.1.142); from 6.2, before 6.6.95 (fixed in 6.6.95); from 6.7, before 6.12.35 (fixed in 6.12.35); from 6.13, before 6.15.4 (fixed in 6.15.4); version 6.16 only

Published 2025-07-04. Last modified 2026-07-30.