CVE-2025-38275: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
In the Linux kernel, the following vulnerability has been resolved:
phy: qcom-qmp-usb: Fix an NULL vs ISERR() bug
The qmpusbiomap() helper function currently returns the raw result of devmioremap() for non-exclusive mappings. Since devmioremap() may return a NULL pointer and the caller only checks error pointers with ISERR(), NULL could bypass the check and lead to an invalid dereference.
Fix the issue by checking if devmioremap() returns NULL. When it does, qmpusbiomap() now returns an error pointer via IOMEMERRPTR(-ENOMEM), ensuring safe and consistent error handling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (phy: qcom-qmp-usb)to a version that resolves this vulnerability.Patch phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug - Configuration
Update qmp_usb_iomap() to check devm_ioremap() for NULL and return an error pointer using IOMEM_ERR_PTR(-ENOMEM), so callers that use IS_ERR() handle failures safely and consistently.
phy: qcom-qmp-usb (qmp_usb_iomap helper) Return value when devm_ioremap() returns NULL = IOMEM_ERR_PTR(-ENOMEM)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38275?
CVE-2025-38275 has been classified as a high severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38275?
To fix CVE-2025-38275, update to the latest version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2025-38275?
CVE-2025-38275 affects Linux kernel versions from 5.15.93 to 5.16, 6.1 to 6.1.142, 6.2 to 6.6.94, 6.7 to 6.12.34, and 6.13 to 6.15.3.
What is the nature of the vulnerability in CVE-2025-38275?
CVE-2025-38275 involves a NULL pointer dereference due to a bug in the qmp_usb_iomap() helper function.
Is there a workaround for CVE-2025-38275?
Currently, the recommended solution for CVE-2025-38275 is to apply the kernel update instead of a workaround.