CVE-2025-38737
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In the Linux kernel, the CIFS (SMB) subsystem has an uninitialized 'buffer' variable in smb3_init_transform_rq(), potentially causing an oops during folio buffer allocation.
Risk Assessment
The organization may experience system crashes during SMB share operations, disrupting file access.
Recommendation
Update the Linux kernel to a version that initializes the 'buffer' variable to NULL.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should start a fresh buffer, but the value is currently undefined.