Vulnerability in pinctrl: aspeed package - Potential NULL Dereference in aspeed_pinmux_set_mux()

Kernel Updated 02 Oct 2025

Summary

31/07/2022

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

GSD-2022-1004381: pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux(). Affects Kernel versions < 3cb392b64304a05bf647e2e44efacd9a1f3c3c6a. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The pinctrl: aspeed package is a component of the Linux Kernel. It provides functionality for handling pin control and multiplexing on ASPEED SoCs. This package is responsible for configuring and managing the pins on ASPEED SoCs, allowing different functionalities to be assigned to the pins. The vulnerability in question affects the aspeed_pinmux_set_mux() function within the package.

Vulnerability Detail

The vulnerability in aspeed_pinmux_set_mux() function in the pinctrl: aspeed package could potentially lead to a NULL dereference. This means that under certain conditions, a pointer within the function could be accessed when it is not pointing to a valid memory location. This could result in a system crash or other unexpected behavior. The impact and likelihood of an attack exploiting this vulnerability have not been proven yet.

How To Fix

No fixed version is published for this vulnerability.

The vulnerability has been fixed in the Linux Kernel version v5.15.56 by commit 3cb392b64304a05bf647e2e44efacd9a1f3c3c6a. To fix the vulnerability, users should update their Linux Kernel to version v5.15.56 or later. This can be done by pulling the latest changes from the official Linux Kernel repository and rebuilding the kernel.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the Linux Kernel to the fixed version.

Conclusion

In conclusion, the pinctrl: aspeed package in the Linux Kernel is vulnerable to a potential NULL dereference in the aspeed_pinmux_set_mux() function. This vulnerability has been fixed in Linux Kernel version v5.15.56. Users are advised to update their Linux Kernel to the fixed version to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for Kernel →