5.5

CVE-2025-38208: linux NULL Pointer Dereference

CVSS: 5.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-38208DEBIAN-CVE-2025-38208
Published 04-07-2025Last modified 23-05-2026
Open JSON

Vulnerability summary

CVE-2025-38208 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.9% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.18%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 40 · Related 38
MGASA-2025-0218MGASA-2025-0219OPENSUSE-SU-2025:20081-1SUSE-SU-2025:03272-1SUSE-SU-2025:03290-1SUSE-SU-2025:03301-1

Timeline

  1. 04-07-2025
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automount_fullpath page is checked for null in __build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not set. However, the check is missing when it is set. Add a check to prevent a potential NULL pointer dereference.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

+0.02 pp

From 0.16% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu147 products
  • linuxAll versions (No fix recorded) | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ d5a863a153e90996ab2aef6b9e08d509f4d5662b, < 37166d63e42c34846a16001950ecec96229a8d17 | ≥ d5a863a153e90996ab2aef6b9e08d509f4d5662b, < a9e916fa5c7d0ec2256aa44aa24ddd92f529ce35 | ≥ d5a863a153e90996ab2aef6b9e08d509f4d5662b, < cce8e71ca1f7ad9045707f0d22490c1e9ed1df6c | ≥ d5a863a153e90996ab2aef6b9e08d509f4d5662b, < f1e7a277a1736e12cc4bd6d93b8a5c439b8ca20c | e91802036b3e6e6e803a17ddf5783a6354fe5380 | ≥ 6.2.13, < 6.3 | 6.3
  • linux_kernel< 6.6.95 | ≥ 6.7, < 6.12.35 | ≥ 6.13, < 6.15.4
Debian1 product
  • linux< 6.12.35-1

3 vendors · 150 products

References

31 links
Show all 31 references