CVE-2025-38737

critical · 9.8

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should start a fresh buffer, but the value is currently undefined.

9.8

CVSS

0.4%

EPSS (exploit prob.)

31st

EPSS percentile

2025-09-05

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-908

Affected products

Vendor	Product	Affected versions
linux	linux_kernel	>= 6.12, < 6.12.44
linux	linux_kernel	>= 6.13, < 6.16.4
linux	linux_kernel	6.17
linux	linux_kernel	6.17

Check a specific version with /api/v1/cve/match.

References

https://git.kernel.org/stable/c/453a6d2a68e54a483d67233c6e1e24c4095ee4be
https://git.kernel.org/stable/c/4931fe2dbe1cc0e7d350a4b51b0b330e43971d98
https://git.kernel.org/stable/c/6adaa9fae36f848afa7278945d725e197e33c496

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-38737