Critical NULL Pointer Dereference in Linux Kernel - uclogic Package Vulnerability
Summary
CVE-2025-38007: In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Add NULL check in uclogic_input_configured() devm_kasprintf() returns NULL when memory allocation fails. Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and flexibility, making it a popular choice for various environments, including servers, desktops, and embedded systems. The uclogic driver, part of the Linux kernel, facilitates input from various graphics tablets and similar devices. This vulnerability arises from a failure to check for NULL pointers during memory allocation, potentially leading to system crashes or unexpected behavior.
Vulnerability Detail
The vulnerability identified as CVE-2025-38007 is a NULL pointer dereference in the uclogic_input_configured() function of the Linux kernel. This issue occurs when the devm_kasprintf() function fails to allocate memory and returns NULL. The lack of a subsequent NULL check in the uclogic_input_configured() function can lead to a NULL pointer dereference, resulting in a system crash or instability. This vulnerability affects users of the Linux kernel, particularly those utilizing devices supported by the uclogic driver.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
CVE-2025-38007 represents a significant vulnerability within the Linux kernel's uclogic driver, necessitating prompt attention from users to prevent potential system instability. Updating to the patched versions is crucial for maintaining system integrity and security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38007 is a vulnerability in the Linux kernel's uclogic driver that can lead to a NULL pointer dereference, causing system crashes.
If your system uses the uclogic driver, this vulnerability could lead to instability or crashes when the driver attempts to access unallocated memory.
You should update your Linux package to the patched version as soon as possible to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Failure to address this vulnerability could lead to system crashes, data loss, or exploitation by malicious actors, compromising system security.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
