What is CVE-2025-39692?

CVE-2025-39692 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, classified as a NULL Pointer Dereference flaw (CWE-476), affecting Linux kernel versions from 5.15 onward and patched in 6.1.149, 6.6.103, 6.12.44 and others. CVE-2025-39692 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2025-39692?

CVE-2025-39692 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2025-39692?

Yes, CVE-2025-39692 has been patched. Fixed versions include 6.1.149, 6.6.103, 6.12.44 and others. If you are running Linux kernel 5.15 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2025-39692 actively exploited?

CVE-2025-39692 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is NULL Pointer Dereference (CWE-476)?

The product dereferences a pointer that it expects to be valid but is NULL, typically causing a crash. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/476.html

CVE-2025-39692

Medium

In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.

Package Linux Kernel

Published 2025-09-05

Last modified 2026-05-12

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-476

CVE-2025-39692 is a NULL Pointer Dereference vulnerability

What is NULL Pointer Dereference?

The product dereferences a pointer that it expects to be valid but is NULL, typically causing a crash. Learn more on MITRE CWE

Affected versions

Linux kernel versions 5.15 and later are affected. Fixed in 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17 and their respective stable series.

Affected from

≥ 5.15

Fixed in

✓ 6.1.149 6.1.x ✓ 6.6.103 6.6.x ✓ 6.12.44 6.12.x ✓ 6.16.4 6.16.x ✓ 6.17

References

7 total

Kernel Git
https://git.kernel.org/stable/c/003e6a3150299f681f34cb189aa068018cef6a45

Patch
Kernel Git
https://git.kernel.org/stable/c/212eb86f75b4d7b82f3d94aed95ba61103bccb93

Patch
Kernel Git
https://git.kernel.org/stable/c/524e90e58a267dad11e23351d9e4b1f941490976

Patch
Kernel Git
https://git.kernel.org/stable/c/bac7b996d42e458a94578f4227795a0d4deef6fa

Patch
Kernel Git
https://git.kernel.org/stable/c/e41e33400516702427603f8fbbec43c91ede09c0

Patch

Showing 5 of 7 references View all on NVD

Details

CVE ID CVE-2025-39692

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2025-09-05

Modified 2026-05-12

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2025-39692?

CVE-2025-39692 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as a NULL Pointer Dereference flaw (CWE-476) . It affects Linux kernel versions from 5.15 onward and has been patched in 6.1.149, 6.6.103, 6.12.44 and others. CVE-2025-39692 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2025-39692?

CVE-2025-39692 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2025-39692?

Yes. CVE-2025-39692 has been patched. Fixed versions include 6.1.149, 6.6.103, 6.12.44 and others. If you are running Linux kernel 5.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2025-39692 actively exploited?

No. CVE-2025-39692 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.