NULL Pointer Dereference in Linux Kernel - aspeed LPC Snoop Function Vulnerability
Summary
CVE-2025-38145: In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() devm_kasprintf() returns NULL when memory allocation fails. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including various distributions of Debian. It manages hardware resources and provides essential services for software applications. The kernel is known for its stability and performance, but vulnerabilities can arise, potentially compromising system integrity and security. This specific vulnerability affects the aspeed LPC snoop function, which is responsible for managing memory access in certain hardware configurations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the aspeed_lpc_enable_snoop() function. The issue arises from a failure to check for NULL return values from the devm_kasprintf() function, which allocates memory. If memory allocation fails, the function returns NULL, leading to a NULL pointer dereference. This can cause system crashes or unpredictable behavior, posing a significant risk to system stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel as described in the 'how_to_fix' section.
Conclusion
The CVE-2025-38145 vulnerability in the Linux kernel poses a serious risk due to a NULL pointer dereference in the aspeed LPC snoop function. Users are strongly advised to update their systems to the latest kernel version to ensure protection against this issue. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38145 is a vulnerability in the Linux kernel related to a NULL pointer dereference in the aspeed LPC snoop function.
This vulnerability can lead to system crashes or unpredictable behavior, potentially compromising system stability and security.
The vulnerability affects Linux versions in Debian 11, 12, and 13. Users should check their kernel version and update accordingly.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
