CVE-2025-38655: pinctrl: canaan: k230: add NULL check in DT parse
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: canaan: k230: add NULL check in DT parse
Add a NULL check for the return value of ofgetproperty() when retrieving the "pinmux" property in the group parser. This avoids a potential NULL pointer dereference if the property is missing from the device tree node.
Also fix a typo ("sintenel") in the device ID match table comment, correcting it to "sentinel".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1020.21~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-36.36.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16~24.04.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38655?
CVE-2025-38655 is considered a medium severity vulnerability due to the potential for a NULL pointer dereference.
How do I fix CVE-2025-38655?
To fix CVE-2025-38655, update the Linux kernel to a version that includes the NULL check for the 'pinmux' property in the group parser.
What type of systems are affected by CVE-2025-38655?
CVE-2025-38655 affects systems running vulnerable versions of the Linux kernel that use the pinctrl Canaan K230 driver.
Is CVE-2025-38655 a remote exploit vulnerability?
CVE-2025-38655 is not a remote exploit vulnerability, as it requires local access to trigger the NULL pointer dereference.
What are the potential impacts of CVE-2025-38655?
The impact of CVE-2025-38655 could include system crashes or instability due to the NULL pointer dereference if triggered.