CVE-2025-38143

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38143
In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL check in wled_configure() devm_kasprintf() returns NULL when memory allocation fails. Currently, wled_configure() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1be2000b703b02e149f8f2061054489f6c18c972 Patch
https://git.kernel.org/stable/c/21528806560510458378ea52c37e35b0773afaea Patch
https://git.kernel.org/stable/c/4a715be3fe80b68fa55cb3569af3d294be101626 Patch
https://git.kernel.org/stable/c/6a56446595730a5e3f06a30902e23cb037d28146 Patch
https://git.kernel.org/stable/c/9d06ac32c202142da40904180f2669ed4f5073ac Patch
https://git.kernel.org/stable/c/e12d3e1624a02706cdd3628bbf5668827214fa33 Patch
https://git.kernel.org/stable/c/fde314445332015273c8f51d2659885c606fe135 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

18 Dec 2025, 21:24

Type Values Removed Values Added
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/1be2000b703b02e149f8f2061054489f6c18c972 - () https://git.kernel.org/stable/c/1be2000b703b02e149f8f2061054489f6c18c972 - Patch
References () https://git.kernel.org/stable/c/21528806560510458378ea52c37e35b0773afaea - () https://git.kernel.org/stable/c/21528806560510458378ea52c37e35b0773afaea - Patch
References () https://git.kernel.org/stable/c/4a715be3fe80b68fa55cb3569af3d294be101626 - () https://git.kernel.org/stable/c/4a715be3fe80b68fa55cb3569af3d294be101626 - Patch
References () https://git.kernel.org/stable/c/6a56446595730a5e3f06a30902e23cb037d28146 - () https://git.kernel.org/stable/c/6a56446595730a5e3f06a30902e23cb037d28146 - Patch
References () https://git.kernel.org/stable/c/9d06ac32c202142da40904180f2669ed4f5073ac - () https://git.kernel.org/stable/c/9d06ac32c202142da40904180f2669ed4f5073ac - Patch
References () https://git.kernel.org/stable/c/e12d3e1624a02706cdd3628bbf5668827214fa33 - () https://git.kernel.org/stable/c/e12d3e1624a02706cdd3628bbf5668827214fa33 - Patch
References () https://git.kernel.org/stable/c/fde314445332015273c8f51d2659885c606fe135 - () https://git.kernel.org/stable/c/fde314445332015273c8f51d2659885c606fe135 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

03 Jul 2025, 15:13

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: backlight: pm8941: Se ha añadido una comprobación de valores NULL en wled_configure(). Devm_kasprintf() devuelve NULL cuando falla la asignación de memoria. Actualmente, wled_configure() no realiza la comprobación en este caso, lo que provoca una desreferencia de puntero NULL. Se ha añadido una comprobación de valores NULL después de devm_kasprintf() para evitar este problema.

03 Jul 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-03 09:15

Updated : 2025-12-18 21:24

NVD link : CVE-2025-38143

Mitre link : CVE-2025-38143

CVE.ORG link : CVE-2025-38143

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference