CVE-2025-38134: usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()
In the Linux kernel, the following vulnerability has been resolved:
usb: acpi: Prevent null pointer dereference in usbacpiaddusb4devlink()
As demonstrated by the fix for updateportdevicestate, commit 12783c0b9e2c ("usb: core: Prevent null pointer dereference in updateportdevicestate"), usbhubtostructhub() can return NULL in certain scenarios, such as during hub driver unbind or teardown race conditions, even if the underlying usbdevice structure exists.
Plus, all other places that call usbhubtostructhub() in the same file do check for NULL return values.
If usbhubtostructhub() returns NULL, the subsequent access to hub->ports[udev->portnum - 1] will cause a null pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.35-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.34 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.15.3 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38134?
CVE-2025-38134 is classified as a moderate severity vulnerability due to the potential for a null pointer dereference in the Linux kernel.
How do I fix CVE-2025-38134?
To fix CVE-2025-38134, you should update your Linux kernel to the latest stable version that includes the applied patches.
What are the potential impacts of CVE-2025-38134?
The impact of CVE-2025-38134 may lead to system instability, crashes, or undefined behavior when a null pointer is dereferenced.
Which versions of the Linux kernel are affected by CVE-2025-38134?
CVE-2025-38134 affects multiple versions of the Linux kernel that allow the null pointer dereference vulnerability.
Is CVE-2025-38134 being actively exploited?
As of now, there have been no reported active exploits specifically targeting CVE-2025-38134.