{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2025-38092",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2025-38092"
  ],
  "published": "2025-07-02T14:44:04Z",
  "summary": "ksmbd: use list_first_entry_or_null for opinfo_get_list()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use list_first_entry_or_null for opinfo_get_list()\n\nThe list_first_entry() macro never returns NULL.  If the list is\nempty then it returns an invalid pointer.  Use list_first_entry_or_null()\nto check if the list is empty.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.12.25-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-2712",
            "binary_version": "1:6.12.25-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v6",
            "binary_version": "1:6.12.25-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v7",
            "binary_version": "1:6.12.25-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v7l",
            "binary_version": "1:6.12.25-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v8",
            "binary_version": "1:6.12.25-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.12.25-1+rpt1": {
            "linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16",
            "upstream_version": "6.12.25",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.32"
          }
        }
      }
    },
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:13",
        "name": "linux"
      },
      "versions": [
        "1:6.12.25-1+rpt1+trixie"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-2712",
            "binary_version": "1:6.12.25-1+rpt1+trixie"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v6",
            "binary_version": "1:6.12.25-1+rpt1+trixie"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v7",
            "binary_version": "1:6.12.25-1+rpt1+trixie"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v8",
            "binary_version": "1:6.12.25-1+rpt1+trixie"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.25-1+rpt1+trixie"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.12.25-1+rpt1+trixie": {
            "linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16",
            "upstream_version": "6.12.25",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.32"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38092"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c78abb646ff823e7d22faad4cc0703d4484da9e8"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/334da674b25fdb7a1a4d4b89dcd7795144fc7e11"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cb7e06e9736d73007dc8dab7b353733bb37df86b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/10379171f346e6f61d30d9949500a8de4336444a"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T12:19:11Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:N - ksmbd is the in-kernel SMB server; the vulnerable path is driven entirely by remote SMB2 CREATE, LOCK and CLOSE requests arriving on TCP/445 from a remote client. No local access is required.\nAC:L - The attacker controls both sides of the race by issuing concurrent SMB2 CREATE/LOCK and CLOSE requests on multiple connections against the same file, and the window is actively widened because down_read() in opinfo_get_list() blocks behind the racing opinfo_del() down_write() that empties the list.\nPR:L - Reaching smb_grant_oplock()/smb_break_all_oplock() requires an established SMB2 session, a tree connect and open file handles, so a valid (even low-privilege or guest-mapped) SMB account is needed; this is not a pre-authentication code path.\nUI:N - The attacker drives every step from its own SMB connections \u2014 opening handles with oplocks/leases and closing them concurrently. No action by any other user or administrator is needed.\nS:U - The type confusion corrupts kernel heap memory belonging to the ksmbd subsystem within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The fake oplock_info causes reads through attacker-timed wild pointers \u2014 opinfo->conn resolves to an rwsem waiter on another task's kernel stack and o_lease to an arbitrary kernel pointer \u2014 and such heap type confusion is leverageable into arbitrary kernel memory disclosure.\nI:H - atomic_inc_not_zero() performs a real RMW write onto the upper half of ksmbd_inode->m_hash.pprev, corrupting a kernel pointer that hlist_del_init() later writes through, and follow-on oplock_break()/opinfo_put() paths add out-of-bounds wait-queue list writes and kfree() of interior pointers \u2014 classic type confusion promotable to a write primitive.\nA:H - Dereferencing and atomically modifying a bogus pointer derived from the list head, plus spinlock/wait-queue operations past the end of the kmalloc'd ksmbd_inode, reliably produce slab corruption, oops or panic, taking down the file server host."
    }
  }
}