CVE-2025-38381: Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt()
In the Linux kernel, the following vulnerability has been resolved:
Input: cs40l50-vibra - fix potential NULL dereference in cs40l50uploadowt()
The cs40l50uploadowt() function allocates memory via kmalloc() without checking for allocation failure, which could lead to a NULL pointer dereference.
Return -ENOMEM in case allocation fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update cs40l50_upload_owt() to check whether kmalloc() fails and return -ENOMEM on allocation failure, preventing a NULL pointer dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38381?
CVE-2025-38381 has been classified with a medium severity level due to the potential for NULL pointer dereference.
How do I fix CVE-2025-38381?
To fix CVE-2025-38381, update your Linux kernel to the latest version where this vulnerability has been resolved.
What causes the vulnerability in CVE-2025-38381?
The vulnerability in CVE-2025-38381 is caused by the cs40l50_upload_owt() function not checking for memory allocation failures.
Which versions of the Linux kernel are affected by CVE-2025-38381?
CVE-2025-38381 affects specific versions of the Linux kernel that include the cs40l50-vibra driver before the fix was applied.
Is there a workaround for CVE-2025-38381?
Currently, there are no documented workarounds for CVE-2025-38381, and applying the kernel update is the recommended action.