CVE-2025-38487: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
In the Linux kernel, the following vulnerability has been resolved:
soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
Mitigate e.g. the following:
# echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... [ 120.363594] Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write [ 120.373866] [00000004] pgd=00000000 [ 120.377910] Internal error: Oops: 805 [#1] SMP ARM [ 120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh Not tainted 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NONE ... [ 120.679543] Call trace: [ 120.679559] miscderegister from aspeedlpcsnoopremove+0x84/0xac [ 120.692462] aspeedlpcsnoopremove from platformremove+0x28/0x38 [ 120.700996] platformremove from devicereleasedriverinternal+0x188/0x200 ...
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38487?
CVE-2025-38487 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38487?
To fix CVE-2025-38487, ensure that your Linux kernel is updated to the latest version that contains the patch.
What issues does CVE-2025-38487 address?
CVE-2025-38487 addresses a flaw regarding the lpc-snoop functionality in the Linux kernel related to disabling channels improperly.
Which systems are affected by CVE-2025-38487?
CVE-2025-38487 affects systems running vulnerable versions of the Linux kernel that use aspeed-lpc-snoop.
Has CVE-2025-38487 been publicly disclosed?
Yes, CVE-2025-38487 has been publicly disclosed as part of a security update for the Linux kernel.