PT-2025-36267 · Linux+2 · Linux Kernel+2

Published 2025-08-19 · Updated 2026-04-07 · CVE-2025-38737

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains an issue in the CIFS implementation where the smb3 init transform rq() function does not initialize a buffer to NULL before calling netfs alloc folioq buffer(). This can lead to an oops condition because netfs expects to append to a valid buffer, but the value is undefined.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Buffer Overflow

Weakness Enumeration

CWE-908

CWE-120

Related Identifiers

ALSA-2025:22854

BDU:2025-15191

CVE-2025-38737

DSA-6008-1

RHSA-2025:22854

RHSA-2025:23009

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38737.json · Exploit
• https://ubuntu.com/security/CVE-2025-38737 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-38737 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-25754.html · Vendor Advisory
• https://git.kernel.org/stable/c/4931fe2dbe1cc0e7d350a4b51b0b330e43971d98 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38737 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-38737 · Vendor Advisory
• https://git.kernel.org/stable/c/453a6d2a68e54a483d67233c6e1e24c4095ee4be · Patch
• https://osv.dev/vulnerability/CVE-2025-38737 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-38737 · Security Note
• https://git.kernel.org/stable/c/6adaa9fae36f848afa7278945d725e197e33c496 · Patch
• https://osv.dev/vulnerability/DSA-6008-1 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2025-22854.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15191 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-38737 · Vendor Advisory