In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should start a fresh buffer, but the value is currently undefined.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2025090544-CVE-2025-38737-4cde@gregkh/T
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:22854 https://access.redhat.com/errata/RHSA-2025:22854
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2025:23009 https://access.redhat.com/errata/RHSA-2025:23009