CVE-2025-38145

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()

devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.

[arj: Fix Fixes: tag to use subject from 3772e5da4454]

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
LinuxLinux>= 3772e5da445420543b25825ac2b5971f3743f6e8, < 2beee9cf833374550e673d428ad8b6ab37c175b3; >= 3772e5da445420543b25825ac2b5971f3743f6e8, < c550999f939b529d28a914d5034cc4290066aea6; >= 3772e5da445420543b25825ac2b5971f3743f6e8, < 1fd889c145722579aa038c31cbc07cfdd4d75166; >= 3772e5da445420543b25825ac2b5971f3743f6e8, < d62a589eaaec6385e3e2b25cf5a28b4560ace93f; >= 3772e5da445420543b25825ac2b5971f3743f6e8, < 8312b1f776f71979bf33bda7acc05b348e8792c7; >= 3772e5da445420543b25825ac2b5971f3743f6e8, < f697ef117ecbf3a367dfc559a6a3589905956530; >= 3772e5da445420543b25825ac2b5971f3743f6e8, < 45b2e8b0fdd280aba04c3cc869e9ae500c44e4b7; >= 3772e5da445420543b25825ac2b5971f3743f6e8, < f1706e0e1a74b095cbc60375b9b1e6205f5f4c98
LinuxLinux4.19

References

Timeline

Published
Jul 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-381467.8In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS CVE-2025-381475.5In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reportCVE-2025-381485.5In the Linux kernel, the following vulnerability has been resolved: net: phy: mscc: Fix memory leak when using one step timestamping Fix mCVE-2025-381495.5In the Linux kernel, the following vulnerability has been resolved: net: phy: clear phydev->devlink when the link is deleted There is a poCVE-2025-38156.4The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, CVE-2025-381505.5In the Linux kernel, the following vulnerability has been resolved: af_packet: move notifier's packet_dev_mc out of rcu critical section SCVE-2025-381515.5In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work The CVE-2025-381525.5In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Clear table_sz when rproc_shutdown There is case as CVE-2025-381537.1In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: fix error handling of usbnet read calls Syzkaller, cCVE-2025-381547.8In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->skCVE-2025-381555.5In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() devm_CVE-2025-381565.5In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() devm_
CVE-2025-38145: Medium severity, CVSS 5.5 | Vulnix