UBUNTU-CVE-2025-38655: Null Pointer Dereference

Q: What conditions are required to trigger the issue?

A device tree node must be parsed by the Canaan K230 pinctrl group parser without a "pinmux" property. The missing property can cause of_get_property() to return NULL, followed by a NULL pointer dereference.

Q: What is the likely impact if it is triggered?

The reported impact is availability loss: the vulnerability is rated medium with an availability impact of high. The supplied vector indicates local access and low privileges are required, with no user interaction.

Q: Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-riscv, ubuntu/linux-hwe-edge, ubuntu/linux-azure-fde, ubuntu/linux-realtime, ubuntu/linux-aws-5.0, ubuntu/linux-aws-5.3, ubuntu/linux-azure, and ubuntu/linux-azure-5.3.

Q: How can I determine whether a system may be exposed?

Check whether the system uses a kernel package listed for this issue and whether it parses device tree configurations for the Canaan K230 pinctrl driver. Exposure specifically depends on a relevant device tree group node missing the "pinmux" property.

Published Aug 22, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: add NULL check in DT parse Add a NULL check for the return value of ofgetproperty() when retrieving the "pinmux" property in the group parser. This avoids a potential NULL pointer dereference if the property is missing from the device tree node. Also fix a typo ("sintenel") in the device ID match table comment, correcting it to "sentinel".

Affected Software

97 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1020.21~24.04.1

6.14.0-1020.21~24.04.1

ubuntu/linux-hwe-6.11*

ubuntu/linux-intel*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-oem-6.14<6.14.0-1016.16

6.14.0-1016.16

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-36.36.1~24.04.1

6.14.0-36.36.1~24.04.1

ubuntu/linux-realtime-6.14<6.14.0-1016.16~24.04.1

6.14.0-1016.16~24.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1020.21~24.04.1
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-36.36.1~24.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16~24.04.1
Compensating control
Correct the device ID match table comment typo from "sintenel" to "sentinel".
Compensating control
In the Linux kernel pinctrl: canaan: k230 group parser, add a NULL check for the return value of of_get_property() when retrieving the "pinmux" property, preventing a NULL pointer dereference when the property is missing from the device tree node.

Event History

Aug 22, 2025

CVE Published

via OSV·04:15 PM

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to trigger the issue?

A device tree node must be parsed by the Canaan K230 pinctrl group parser without a "pinmux" property. The missing property can cause of_get_property() to return NULL, followed by a NULL pointer dereference.

What is the likely impact if it is triggered?

The reported impact is availability loss: the vulnerability is rated medium with an availability impact of high. The supplied vector indicates local access and low privileges are required, with no user interaction.

Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-riscv, ubuntu/linux-hwe-edge, ubuntu/linux-azure-fde, ubuntu/linux-realtime, ubuntu/linux-aws-5.0, ubuntu/linux-aws-5.3, ubuntu/linux-azure, and ubuntu/linux-azure-5.3.

How can I determine whether a system may be exposed?

Check whether the system uses a kernel package listed for this issue and whether it parses device tree configurations for the Canaan K230 pinctrl driver. Exposure specifically depends on a relevant device tree group node missing the "pinmux" property.

UBUNTU-CVE-2025-38655: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger the issue?

What is the likely impact if it is triggered?

Which Ubuntu kernel packages are identified as affected?

How can I determine whether a system may be exposed?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the issue?

What is the likely impact if it is triggered?

Which Ubuntu kernel packages are identified as affected?

How can I determine whether a system may be exposed?