CVE-2025-38629

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38629
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: scarlett2: Fix missing NULL check scarlett2_input_select_ctl_info() sets up the string arrays allocated via kasprintf(), but it misses NULL checks, which may lead to NULL dereference Oops. Let's add the proper NULL check.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2c735fcaee81ad8056960659dc9dc460891e76b0 Patch
https://git.kernel.org/stable/c/d558db85920b124bac36f8a7ddc5de0aa7491bdd Patch
https://git.kernel.org/stable/c/df485a4b2b3ee5b35c80f990beb554e38a8a5fb1 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

26 Nov 2025, 17:10

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/2c735fcaee81ad8056960659dc9dc460891e76b0 - () https://git.kernel.org/stable/c/2c735fcaee81ad8056960659dc9dc460891e76b0 - Patch
References () https://git.kernel.org/stable/c/d558db85920b124bac36f8a7ddc5de0aa7491bdd - () https://git.kernel.org/stable/c/d558db85920b124bac36f8a7ddc5de0aa7491bdd - Patch
References () https://git.kernel.org/stable/c/df485a4b2b3ee5b35c80f990beb554e38a8a5fb1 - () https://git.kernel.org/stable/c/df485a4b2b3ee5b35c80f990beb554e38a8a5fb1 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: usb: scarlett2: Se corrige la falta de comprobación de valores NULL. scarlett2_input_select_ctl_info() configura las matrices de cadenas asignadas mediante kasprintf(), pero omite las comprobaciones de valores NULL, lo que puede provocar una desreferencia de valores NULL. ¡Uy! Añadamos la comprobación de valores NULL adecuada.
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CWE CWE-476

22 Aug 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-22 16:15

Updated : 2025-11-26 17:10

NVD link : CVE-2025-38629

Mitre link : CVE-2025-38629

CVE.ORG link : CVE-2025-38629

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference