CVE-2025-38167
MEDIUMLinux Kernel - NULL Pointer Dereference in NTFS3 hdr_first_de Function
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle hdr_first_de() return value The hdr_first_de() function returns a pointer to a struct NTFS_DE. This pointer may be NULL. To handle the NULL error effectively, it is important to implement an error handler. This will help manage potential errors consistently. Additionally, error handling for the return value already exists at other points where this function is called. Found by Linux Verification Center (linuxtesting.org) with SVACE.
References (8)
Core 8
Core References
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Scores
CVSS v3
5.5
EPSS
0.0013
EPSS Percentile
31.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-476
Status
published
Products (21)
debian/debian_linux
11.0
linux/Kernel
5.15.0 - 5.15.186linux
linux/Kernel
5.16.0 - 6.1.142linux
linux/Kernel
6.13.0 - 6.15.3linux
linux/Kernel
6.2.0 - 6.6.94linux
linux/Kernel
6.7.0 - 6.12.34linux
Linux/Linux
< 5.15
Linux/Linux
5.15
Linux/Linux
5.15.186 - 5.15.*
Linux/Linux
6.1.142 - 6.1.*
... and 11 more
Published
Jul 03, 2025
Tracked Since
Feb 18, 2026