CVE-2025-37881: usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: aspeed: Add NULL pointer check in astvhubinitdev()
The variable d->name, returned by devmkasprintf(), could be NULL. A pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in commit 3027e7b15b02 ("ice: Fix some null pointer dereference issues in iceptp.c").
This issue is found by our static analysis tool
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37881?
CVE-2025-37881 has been categorized as a moderate severity vulnerability due to the potential for a NULL pointer dereference.
How do I fix CVE-2025-37881?
To fix CVE-2025-37881, update your Linux kernel to the latest version where the NULL pointer check has been implemented.
What systems are affected by CVE-2025-37881?
CVE-2025-37881 affects all versions of the Linux kernel that include the usb gadget feature.
What impact does CVE-2025-37881 have on system security?
If exploited, CVE-2025-37881 could lead to system instability or crashes due to NULL pointer dereference issues.
Is CVE-2025-37881 related to USB devices?
Yes, CVE-2025-37881 is related to the USB gadget subsystem in the Linux kernel.