CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
In the Linux kernel, the following vulnerability has been resolved:
clk: bcm: rpi: Add NULL check in raspberrypiclkregister()
devmkasprintf() returns NULL when memory allocation fails. Currently, raspberrypiclkregister() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devmkasprintf() to prevent this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Add a NULL check after devm_kasprintf() in raspberrypi_clk_register() and handle the allocation failure before dereferencing the returned pointer.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38160?
CVE-2025-38160 is classified as a moderate severity vulnerability.
How do I fix CVE-2025-38160?
To mitigate CVE-2025-38160, ensure you update to the latest version of the Linux kernel where this issue is resolved.
What systems are affected by CVE-2025-38160?
CVE-2025-38160 affects the Linux kernel implementations that include the bcm clock drivers.
What is the nature of the vulnerability in CVE-2025-38160?
CVE-2025-38160 is caused by a lack of NULL pointer checking in the raspberrypi_clk_register function.
Is CVE-2025-38160 exploitable remotely?
CVE-2025-38160 is not known to be directly exploitable remotely, but it may lead to instability in affected systems.