CVE-2025-38648: spi: stm32: Check for cfg availability in stm32_spi_probe
In the Linux kernel, the following vulnerability has been resolved:
spi: stm32: Check for cfg availability in stm32spiprobe
The stm32spiprobe function now includes a check to ensure that the pointer returned by ofdevicegetmatchdata is not NULL before accessing its members. This resolves a warning where a potential NULL pointer dereference could occur when accessing cfg->hasdevicemode.
Before accessing the 'hasdevicemode' member, we verify that 'cfg' is not NULL. If 'cfg' is NULL, an error message is logged.
This change ensures that the driver does not attempt to access configuration data if it is not available, thus preventing a potential system crash due to a NULL pointer dereference.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38648?
CVE-2025-38648 has a medium severity rating due to the potential for improper access to device members.
How do I fix CVE-2025-38648?
To fix CVE-2025-38648, update the Linux kernel to the latest patched version that includes the fix for the stm32_spi_probe function.
What systems are affected by CVE-2025-38648?
CVE-2025-38648 affects the Linux kernel particularly in systems utilizing STM32 SPI devices.
Are there any known exploits for CVE-2025-38648?
As of now, there are no widely reported exploits for CVE-2025-38648, but it is advisable to apply the patch.
What is the impact of CVE-2025-38648 on the Linux kernel?
The impact of CVE-2025-38648 on the Linux kernel includes possible denial of service or unstable behavior if the vulnerability is exploited.