CVE-2025-38025: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-38025 is a vulnerability discovered in the Linux kernel's Industrial I/O (IIO) ADC driver for the AD7606 device, disclosed on June 18, 2025. The vulnerability involves a NULL pointer dereference that occurs when calling the sw_mode_config() function without proper validation (NVD, Debian Tracker).

The vulnerability exists in the AD7606 ADC driver where the sw_mode_config function pointer is called without first checking if it is NULL. Since not all buses define this callback, this can result in a NULL pointer dereference. The issue affects multiple versions of the Linux kernel and has been assigned a medium priority by Ubuntu (Wiz, Ubuntu).

A NULL pointer dereference in the kernel can lead to system crashes or denial of service conditions, potentially affecting system stability and availability (Wiz).

The vulnerability has been fixed in various Linux kernel versions. Debian has released fixes in multiple versions: bullseye (5.10.223-1), bookworm (6.1.137-1), and trixie (6.12.31-1). Users are advised to update their systems to the patched versions (Debian Tracker).