CVE-2025-38488

Q: What is the severity of CVE-2025-38488?

CVE-2025-38488 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's SMB client when using hardware crypto accelerators. The vulnerability can cause kernel crashes and potential privilege escalation. It affects Linux systems with specific kernel versions that use SMB client functionality with hardware crypto acceleration.

7.8 HIGH

Denial of Service

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's SMB client when using hardware crypto accelerators. The vulnerability can cause kernel crashes and potential privilege escalation. It affects Linux systems with specific kernel versions that use SMB client functionality with hardware crypto acceleration.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions between the introduction of CVE-2024-50047 fix and the CVE-2025-38488 fix

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when using SMB client with hardware crypto accelerators. Systems without hardware crypto acceleration or not using SMB client are not affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, potential privilege escalation to kernel mode, or remote code execution if combined with other vulnerabilities.

🟠

Likely Case

System instability, kernel crashes, and denial of service when using SMB client with hardware crypto accelerators.

🟢

If Mitigated

No impact if patched or if hardware crypto accelerators are not used with SMB client.

🌐 Internet-Facing: MEDIUM - Requires SMB client usage which is less common for internet-facing services, but possible in specific configurations.

🏢 Internal Only: MEDIUM - Affects internal systems using SMB client with hardware crypto acceleration.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires specific hardware crypto accelerator usage and SMB client operations. The vulnerability is a use-after-free that could potentially be leveraged for privilege escalation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commit 15a0a5de49507062bc3be4014a403d8cea5533de or later

Vendor Advisory: https://git.kernel.org/stable/c/15a0a5de49507062bc3be4014a403d8cea5533de

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commit 2. Reboot system to load new kernel 3. Verify kernel version after reboot

🔧 Temporary Workarounds

Disable hardware crypto acceleration for SMB

linux

Prevent use of hardware crypto accelerators for SMB operations

echo 0 > /sys/module/crypto/parameters/use_hardware_acceleration

Disable SMB client usage

linux

Avoid using SMB client functionality if not required

modprobe -r cifs
modprobe -r smb3

🧯 If You Can't Patch

Disable hardware crypto acceleration for SMB operations
Avoid using SMB client functionality or restrict to trusted networks only

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if it's between affected versions. Check if SMB modules are loaded and hardware crypto is enabled.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version contains the fix commit 15a0a5de49507062bc3be4014a403d8cea5533de

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
NULL pointer dereference errors in kernel logs
SMB client crash reports

Network Indicators:

SMB protocol errors
Unexpected SMB connection drops

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "use-after-free" OR "kernel panic") AND process="smb"

📊 Metadata

CVE ID: CVE-2025-38488

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.01% exploit probability (1th percentile)

Published: July 28, 2025

Last Updated: January 7, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable hardware crypto acceleration for SMB

Disable SMB client usage

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities