Null Pointer Dereference in Linux Kernel's Raspberry Pi Clock Registration
Summary
CVE-2025-38160: In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() devm_kasprintf() returns NULL when memory allocation fails. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It is widely used in various distributions, including Debian. The kernel's functionality includes managing processes, memory, and device drivers. This vulnerability specifically affects the Raspberry Pi clock registration function, which is crucial for managing clock signals in Raspberry Pi devices. The lack of a NULL check in the clock registration process can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, specifically within the Raspberry Pi clock registration function (raspberrypi_clk_register), a vulnerability has been identified due to the absence of a NULL check after calling devm_kasprintf(). When memory allocation fails, devm_kasprintf() returns NULL, leading to a potential NULL pointer dereference. This can cause the system to crash or behave unpredictably, posing a significant risk to system stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-38160 vulnerability in the Linux kernel poses a significant risk due to a NULL pointer dereference in the Raspberry Pi clock registration function. Users are advised to update their systems to the latest patched version to ensure stability and security. Monitoring tools like Vulert can help keep track of vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38160 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference due to a missing NULL check in the raspberrypi_clk_register function.
This vulnerability can cause system crashes and instability, particularly in systems using Raspberry Pi hardware.
Yes, if you are using Debian 11, 12, or 13 with the Linux kernel, your system may be affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
