Critical NULL Pointer Dereference in Linux Kernel - linux Package Vulnerability
Summary
DEBIAN-CVE-2025-38381: In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() The cs40l50_upload_owt() function allocates memory via kmalloc() without c... Affects linux versions < 6.12.37-1. Fixed in 6.12.37-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux package is a core component of the Debian operating system, providing the Linux kernel that manages system resources and hardware interactions. It is essential for the functioning of the operating system, enabling communication between software and hardware. This vulnerability affects versions of the linux package in Debian 13 and 14, potentially compromising system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the cs40l50-vibra driver, specifically within the cs40l50_upload_owt() function. This function allocates memory using kmalloc() but fails to check if the allocation was successful. If the allocation fails, it can lead to a NULL pointer dereference, which may cause the system to crash or behave unpredictably. The vulnerability is classified as a memory management issue, and it poses risks of denial of service or exploitation by malicious actors.
How To Fix
Minimum fixed version
6.12.37-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it is available to ensure system security.
Conclusion
The identified vulnerability in the linux package poses significant risks to system stability and security. Users are strongly advised to update their systems to the patched version to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the cs40l50-vibra driver of the Linux kernel, which can lead to system crashes.
The vulnerability affects the linux package in Debian 13 and 14, specifically versions prior to 6.12.37-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability could lead to denial of service, system instability, or unauthorized access to system resources.
Yes, a patch is available in version 6.12.37-1 of the linux package. It is crucial to update to this version or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
