Critical Null Pointer Dereference in Linux Kernel Package: linux
Summary
DEBIAN-CVE-2025-38156: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() devm_ioremap() returns NULL on error. Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linux' package is the core of the Debian operating system, providing essential functionalities for hardware interaction, process management, and system resource allocation. It is a critical component that ensures the stability and performance of the system. However, vulnerabilities within the kernel can lead to severe security risks, including system crashes or unauthorized access.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mt7996_mmio_wed_init() function, where a null pointer dereference occurs if the devm_ioremap() function returns NULL on error. This oversight can lead to system instability and potential exploitation by malicious actors, as it allows for unexpected behavior or crashes in the system.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel's linux package poses significant risks to system stability and security. Users are strongly advised to update to the patched version 6.12.35-1 to mitigate these risks effectively. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a null pointer dereference in the mt7996_mmio_wed_init() function of the Linux kernel, which can lead to system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The risks include potential system instability, crashes, and exploitation by attackers, which could lead to unauthorized access or data loss.
Yes, a patch is available in version 6.12.35-1 of the linux package. Users should update to this version to mitigate the risk.
If you cannot update immediately, monitor your system closely for any unusual behavior and consider implementing additional security measures until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
