Kernel NULL Pointer Dereference Vulnerability in Linux Package
Summary
CVE-2025-38152: In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Clear table_sz when rproc_shutdown There is case as below could trigger kernel dump: Use U-Boot to start remote processor(rproc) with... Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various devices, including servers, desktops, and embedded systems. This vulnerability affects the remote processor (rproc) functionality, specifically in the context of firmware loading and resource table management.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the remoteproc subsystem where a NULL pointer dereference can occur. This issue arises when a remote processor is stopped, and a new firmware without a resource table is loaded. The kernel attempts to copy a cached resource table that has been set to NULL, leading to a crash. This vulnerability can result in a kernel panic, causing system instability and potential data loss. The issue has been observed on i.MX8MP and i.MX9 hardware platforms.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid loading firmware without a resource table after stopping a remote processor. This can prevent the NULL pointer dereference from occurring until the system can be updated with the patched version.
Conclusion
The CVE-2025-38152 vulnerability in the Linux kernel poses a significant risk due to the potential for kernel crashes when handling remote processors. Users are advised to update their systems promptly to mitigate this risk and can utilize workarounds until a patch is applied.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38152 is a vulnerability in the Linux kernel's remoteproc subsystem that can lead to a kernel NULL pointer dereference.
The vulnerability has been identified on i.MX8MP and i.MX9 hardware platforms.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
As a temporary measure, avoid loading firmware that does not include a resource table after stopping a remote processor.
Detailed information can be found in the CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
