Security readout for executives and security teams
Plain-English summary
A remote client can crash a Linux system’s ksmbd SMB service during Kerberos session setup, causing service disruption and potentially broader host instability. The issue does not expose or alter data according to the supplied CVSS assessment. Risk is concentrated on systems that enable ksmbd, use Kerberos authentication, and accept SMB connections from untrusted networks.
Executive priority
Prioritize exposed ksmbd servers and business-critical file services. Patch promptly where Kerberos authentication is used or SMB is reachable beyond trusted networks. Systems without ksmbd are not indicated as exposed by the supplied description. Treat service restriction or disablement as interim controls, then verify the vendor kernel contains the fix.
Technical view
During Kerberos session setup, a client-supplied PreviousSessionId can reach destroy_previous_session() before sess->user is initialized, causing a NULL pointer dereference. The kernel fix moves this call until after ksmbd_krb5_authenticate() sets the user. CVSS 3.1 is 7.5: network-reachable, low complexity, no privileges or interaction, with availability impact only.
Likely exposure
Likely exposure requires the Linux kernel ksmbd SMB server and the affected Kerberos session-setup path. Internet-facing or broadly reachable SMB services carry greater risk. The supplied affected-version data is ambiguous and includes unusual entries, so determine exposure using the running distribution kernel and its vendor advisory rather than version strings alone.
Exploitation context
The supplied record is not in CISA KEV, and no provided evidence establishes active exploitation. Its CVSS vector indicates an unauthenticated remote availability attack is possible. A client-controlled PreviousSessionId during Kerberos session setup can trigger the vulnerable state, but practical reliability and host-level consequences are not established by the supplied evidence.
Researcher notes
The defect is an ordering error: destroy_previous_session() receives a NULL user before Kerberos authentication initializes sess->user. The cited correction reorders that operation. The bundle provides several stable-kernel commits but does not clearly map each affected release to a fixed release. No confidentiality or integrity impact, exploit publication, or active campaign is established here.
Mitigation direction
- Install a vendor-supported kernel containing the referenced ksmbd fix.
- Consult the Linux distribution’s advisory to map fixed package versions accurately.
- Disable ksmbd if SMB service is unnecessary.
- Restrict SMB access to trusted networks and clients until patched.
Validation and detection
- Confirm whether ksmbd is enabled or loaded on each Linux host.
- Identify whether ksmbd uses Kerberos authentication in the deployed configuration.
- Record the running kernel and distribution package versions.
- Verify the installed kernel includes the applicable referenced stable fix.
- Confirm firewall policy prevents untrusted access to the SMB service.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38191 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/281afc52e2961cd5dd8326ebc9c5bc40904c0468CVE reference, Linux
- https://git.kernel.org/stable/c/0902625a24eea7fdc187faa5d97df244d159dd6eCVE reference, Linux
- https://git.kernel.org/stable/c/1193486dffb7432a09f57f5d09049b4d4123538bCVE reference, Linux
- https://git.kernel.org/stable/c/076f1adefb9837977af7ed233883842ddc446644CVE reference, Linux
- https://git.kernel.org/stable/c/7ac5b66acafcc9292fb935d7e03790f2b8b2dc0eCVE reference, Linux
- https://www.zerodayinitiative.com/advisories/ZDI-25-610/CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.