Kernel Panic Vulnerability in Linux Package: Uninitialized Device Structs in st_sensors
Summary
DEBIAN-CVE-2025-38531: In the Linux kernel, the following vulnerability has been resolved: iio: common: st_sensors: Fix use of uninitialize device structs Throughout the various probe functions &indio_dev->dev is used before it is initialized. Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including device drivers, system calls, and process management. The vulnerability in question arises from the improper initialization of device structures within the st_sensors driver, which can lead to system instability and kernel panics.
Vulnerability Detail
In the Linux kernel, specifically within the st_sensors driver, there exists a vulnerability related to the use of uninitialized device structures. During various probe functions, the device structure 'indio_dev->dev' is accessed before it has been properly initialized. This oversight can trigger a kernel panic in the function 'st_sensors_power_enable()' when the call to 'devm_regulator_bulk_get_enable()' fails, subsequently invoking 'dev_err_probe()' with an uninitialized device. While this issue primarily leads to a panic, other logging functions like 'dev_err()', 'dev_warn()', and 'dev_info()' do not cause a panic but are also addressed in the fix.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed versions mentioned above.
Conclusion
In summary, the vulnerability in the Linux kernel related to uninitialized device structs in the st_sensors driver poses a significant risk of kernel panics. Users are encouraged to update their systems to the patched versions to ensure stability and security. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves the use of uninitialized device structures in the st_sensors driver, which can lead to kernel panics.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The primary consequence is a potential kernel panic, which can cause system crashes and instability.
Yes, patches are available in the updated versions of the Linux package for Debian 13 and 14.
While no specific workarounds are available, it is advisable to prioritize updating your system to mitigate the risk of kernel panics.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
