Null Pointer Dereference in Linux Kernel's NVMEM Driver
Summary
DEBIAN-CVE-2025-38301: In the Linux kernel, the following vulnerability has been resolved: nvmem: zynqmp_nvmem: unbreak driver after cleanup Commit 29be47fcd6a0 ("nvmem: zynqmp_nvmem: zynqmp_nvmem_probe cleanup") changed the driver to expect t... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all hardware and software. It manages system resources and enables communication between hardware and software components. The NVMEM subsystem is responsible for managing non-volatile memory, which is crucial for storing configuration data and other persistent information. This vulnerability affects the NVMEM driver for the Zynq UltraScale+ MPSoC, which is used in various embedded systems.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the NVMEM driver for Zynq UltraScale+ MPSoC. The issue arises from a change made in commit 29be47fcd6a0, which altered the driver to expect the device pointer to be passed as the 'context'. However, the context parameter is derived from nvmem_config.priv, which is never set. This oversight can lead to null pointer dereferences when the device is accessed, potentially causing system crashes or instability.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate risks.
Conclusion
The identified vulnerability in the Linux kernel's NVMEM driver poses significant risks due to potential null pointer dereferences. Users are urged to update their systems to the patched version to ensure stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to null pointer exceptions, causing system crashes or instability when the NVMEM driver is accessed.
You can use the Vulert platform to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch has been released in version 6.12.35-1 of the Linux package.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38301.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
