CVE-2025-38095 — NULL Pointer Dereference in Linux

CWE-476 — NULL Pointer DereferenceCWE-821 — Incorrect Synchronization61 documents8 sources
Severity
5.5MEDIUMNVD
OSV7.8OSV3.2
EPSS
0.0%
top 86.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedJul 3
Latest updateMar 25

Description

In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel5.0 — 5.10.241+6
▶Debianlinux/linux_kernel< 5.10.244-1+3
▶Ubuntulinux/linux_kernel< 5.15.0-163.173+1
▶CVEListV5linux/linuxa590d0fdbaa56f482ff515e1040b6d9b1b200d63 — 90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f+7

Also affects: Debian Linux 11.0

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

31
OSV
linux-azure-6.8 vulnerabilities↗2026-03-25
▶
OSV
linux-azure-fips vulnerabilities↗2026-03-04
▶
OSV
linux-azure vulnerabilities↗2026-03-04
▶
OSV
linux-ibm, linux-ibm-6.8 vulnerabilities↗2026-02-24
▶
OSV
linux-xilinx vulnerabilities↗2026-02-24
▶

📋Vendor Advisories

29
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-03-25
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-03-04
▶
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities↗2026-03-04
▶
Ubuntu
Linux kernel (Xilinx) vulnerabilities↗2026-02-24
▶
Ubuntu
Linux kernel (IBM) vulnerabilities↗2026-02-24
▶
CVE-2025-38095 — NULL Pointer Dereference in Linux | cvebase