CVE-2025-38648 (GCVE-0-2025-38648)
Vulnerability from cvelistv5
Published
2025-08-22 16:00
Modified
2025-08-22 16:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: stm32: Check for cfg availability in stm32_spi_probe
The stm32_spi_probe function now includes a check to ensure that the
pointer returned by of_device_get_match_data is not NULL before
accessing its members. This resolves a warning where a potential NULL
pointer dereference could occur when accessing cfg->has_device_mode.
Before accessing the 'has_device_mode' member, we verify that 'cfg' is
not NULL. If 'cfg' is NULL, an error message is logged.
This change ensures that the driver does not attempt to access
configuration data if it is not available, thus preventing a potential
system crash due to a NULL pointer dereference.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: fee681646fc831b154619ac0261afedcc7e671e7 Version: fee681646fc831b154619ac0261afedcc7e671e7 Version: fee681646fc831b154619ac0261afedcc7e671e7 Version: fee681646fc831b154619ac0261afedcc7e671e7 Version: fee681646fc831b154619ac0261afedcc7e671e7 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-stm32.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6031a54f4eac921efe6122a561d44df89b37f2d4",
"status": "affected",
"version": "fee681646fc831b154619ac0261afedcc7e671e7",
"versionType": "git"
},
{
"lessThan": "a7645815edf4478f3258bb0db95a08986a77f5c0",
"status": "affected",
"version": "fee681646fc831b154619ac0261afedcc7e671e7",
"versionType": "git"
},
{
"lessThan": "3a571a8d52272cc26858ab1bc83d0f66e5dee938",
"status": "affected",
"version": "fee681646fc831b154619ac0261afedcc7e671e7",
"versionType": "git"
},
{
"lessThan": "cc063d23ad80ef7d201c41b2716b1bae7c662cf9",
"status": "affected",
"version": "fee681646fc831b154619ac0261afedcc7e671e7",
"versionType": "git"
},
{
"lessThan": "21f1c800f6620e43f31dfd76709dbac8ebaa5a16",
"status": "affected",
"version": "fee681646fc831b154619ac0261afedcc7e671e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-stm32.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.102",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.102",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.42",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: stm32: Check for cfg availability in stm32_spi_probe\n\nThe stm32_spi_probe function now includes a check to ensure that the\npointer returned by of_device_get_match_data is not NULL before\naccessing its members. This resolves a warning where a potential NULL\npointer dereference could occur when accessing cfg-\u003ehas_device_mode.\n\nBefore accessing the \u0027has_device_mode\u0027 member, we verify that \u0027cfg\u0027 is\nnot NULL. If \u0027cfg\u0027 is NULL, an error message is logged.\n\nThis change ensures that the driver does not attempt to access\nconfiguration data if it is not available, thus preventing a potential\nsystem crash due to a NULL pointer dereference."
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T16:00:52.825Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6031a54f4eac921efe6122a561d44df89b37f2d4"
},
{
"url": "https://git.kernel.org/stable/c/a7645815edf4478f3258bb0db95a08986a77f5c0"
},
{
"url": "https://git.kernel.org/stable/c/3a571a8d52272cc26858ab1bc83d0f66e5dee938"
},
{
"url": "https://git.kernel.org/stable/c/cc063d23ad80ef7d201c41b2716b1bae7c662cf9"
},
{
"url": "https://git.kernel.org/stable/c/21f1c800f6620e43f31dfd76709dbac8ebaa5a16"
}
],
"title": "spi: stm32: Check for cfg availability in stm32_spi_probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38648",
"datePublished": "2025-08-22T16:00:52.825Z",
"dateReserved": "2025-04-16T04:51:24.030Z",
"dateUpdated": "2025-08-22T16:00:52.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-38648\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-22T16:15:39.480\",\"lastModified\":\"2025-08-22T18:08:51.663\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: stm32: Check for cfg availability in stm32_spi_probe\\n\\nThe stm32_spi_probe function now includes a check to ensure that the\\npointer returned by of_device_get_match_data is not NULL before\\naccessing its members. This resolves a warning where a potential NULL\\npointer dereference could occur when accessing cfg-\u003ehas_device_mode.\\n\\nBefore accessing the \u0027has_device_mode\u0027 member, we verify that \u0027cfg\u0027 is\\nnot NULL. If \u0027cfg\u0027 is NULL, an error message is logged.\\n\\nThis change ensures that the driver does not attempt to access\\nconfiguration data if it is not available, thus preventing a potential\\nsystem crash due to a NULL pointer dereference.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/21f1c800f6620e43f31dfd76709dbac8ebaa5a16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3a571a8d52272cc26858ab1bc83d0f66e5dee938\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6031a54f4eac921efe6122a561d44df89b37f2d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a7645815edf4478f3258bb0db95a08986a77f5c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc063d23ad80ef7d201c41b2716b1bae7c662cf9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…