CVE-2025-38328 — NULL Pointer Dereference in Linux
Severity
5.5MEDIUMNVD
OSV5.6OSV3.2
EPSS
0.0%
top 93.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 10
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
Fuzzing hit another invalid pointer dereference due to the lack of
checking whether jffs2_prealloc_raw_node_refs() completed successfully.
Subsequent logic implies that the node refs have been allocated.
Handle that. The code is ready for propagating the error upwards.
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 5835…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux2f785402f39b96a077b6e62bf26164bfb8e0c980 — 7e860296d7808de1db175c1eda29f94a2955dcc4+8
Also affects: Debian Linux 11.0