Null Pointer Dereference Vulnerability in Linux Kernel - CVE-2025-38664
Summary
CVE-2025-38664: In the Linux kernel, the following vulnerability has been resolved: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer derefe... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the 'ice' driver within the kernel, which is responsible for managing Intel Ethernet devices.
Vulnerability Detail
CVE-2025-38664 is a vulnerability in the Linux kernel that arises from a null pointer dereference in the function ice_copy_and_init_pkg(). This issue occurs when the return value of the devm_kmemdup() function is not properly checked, potentially leading to a system crash or unexpected behavior. If exploited, this vulnerability could allow an attacker to disrupt system operations, leading to denial of service or other security implications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-38664 is a critical vulnerability in the Linux kernel that can lead to significant system issues if not addressed. Users are encouraged to update their systems to the latest patched versions to mitigate risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38664 is a vulnerability in the Linux kernel that can lead to a null pointer dereference, potentially causing system crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability could lead to denial of service, causing the system to crash or behave unexpectedly.
Yes, patched versions are available for Debian 13 (6.12.41-1) and Debian 14 (6.16.3-1).
While there are no specific workarounds, it is advisable to monitor the situation and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
