In the Linux kernel, the following vulnerability has been resolved:
cifs: prevent NULL pointer dereference in UTF16 conversion
There can be a NULL pointer dereference bug here. NULL is passed to _cifssfumakenode without checks, which passes it unchecked to cifsstrnduptoutf16, which in turn passes it to cifslocaltoutf16_bytes where '*from' is dereferenced, causing a crash.
This patch adds a check for NULL 'src' in cifsstrndupto_utf16 and returns NULL early to prevent dereferencing NULL pointer.
Found by Linux Verification Center (linuxtesting.org) with SVACE
[
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cifs_unicode.c",
"function": "cifs_strndup_to_utf16"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b98a7e65e7a8f3894d8760cd194eaf20504c99",
"id": "CVE-2025-39838-1d741014",
"digest": {
"function_hash": "97981932487120147822118012253948061822",
"length": 372.0
}
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cifs_unicode.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b98a7e65e7a8f3894d8760cd194eaf20504c99",
"id": "CVE-2025-39838-26f62a98",
"digest": {
"threshold": 0.9,
"line_hashes": [
"185017085308296317147801363289852371781",
"121408314514437613207810632969975098875",
"278374161384962449928906826523910463761"
]
}
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cifs_unicode.c",
"function": "cifs_strndup_to_utf16"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f797f062b5cf13a1c2bcc23285361baaa7c9260",
"id": "CVE-2025-39838-5b53deb4",
"digest": {
"function_hash": "97981932487120147822118012253948061822",
"length": 372.0
}
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cifs_unicode.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f797f062b5cf13a1c2bcc23285361baaa7c9260",
"id": "CVE-2025-39838-90c46867",
"digest": {
"threshold": 0.9,
"line_hashes": [
"185017085308296317147801363289852371781",
"121408314514437613207810632969975098875",
"278374161384962449928906826523910463761"
]
}
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cifs_unicode.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70bccd9855dae56942f2b18a08ba137bb54093a0",
"id": "CVE-2025-39838-91109b51",
"digest": {
"threshold": 0.9,
"line_hashes": [
"185017085308296317147801363289852371781",
"121408314514437613207810632969975098875",
"278374161384962449928906826523910463761"
]
}
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cifs_unicode.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cfa5dd05847137f0fb3ce74ced80c0b4858d716",
"id": "CVE-2025-39838-a3b7e409",
"digest": {
"threshold": 0.9,
"line_hashes": [
"185017085308296317147801363289852371781",
"121408314514437613207810632969975098875",
"278374161384962449928906826523910463761"
]
}
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cifs_unicode.c",
"function": "cifs_strndup_to_utf16"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70bccd9855dae56942f2b18a08ba137bb54093a0",
"id": "CVE-2025-39838-c4ba875c",
"digest": {
"function_hash": "97981932487120147822118012253948061822",
"length": 372.0
}
},
{
"deprecated": false,
"target": {
"file": "fs/smb/client/cifs_unicode.c",
"function": "cifs_strndup_to_utf16"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cfa5dd05847137f0fb3ce74ced80c0b4858d716",
"id": "CVE-2025-39838-fead4330",
"digest": {
"function_hash": "97981932487120147822118012253948061822",
"length": 372.0
}
}
]