CVE-2025-38138: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38138 is a NULL pointer dereference vulnerability in the Linux kernel's Texas Instruments (TI) DMA engine driver (dmaengine/ti). The flaw exists in the udma_probe() function, which fails to check the return value of devm_kasprintf() — a function that can return NULL on memory allocation failure — leading to a NULL pointer dereference. It affects Linux kernel versions 5.6–5.10.238, 5.11–5.15.185, 5.16–6.1.141, 6.2–6.6.93, 6.7–6.12.33, and 6.13–6.15.2, as well as Debian Linux 11.0. Published on July 3, 2025, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In udma_probe(), the kernel calls devm_kasprintf() to dynamically format and allocate a string; however, no NULL check is performed on the returned pointer before it is subsequently used. If the system is under memory pressure and the allocation fails, the function returns NULL, and the subsequent dereference of that pointer causes a kernel panic or crash. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local user on an affected system with the TI UDMA driver loaded (Red Hat CVE).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (kernel panic) and denial of service. The impact is limited to availability (rated High), with no confidentiality or integrity impact. Affected systems include those running vulnerable Linux kernel versions with the TI Universal DMA (UDMA) driver active, which is primarily relevant to embedded and SoC-based platforms using Texas Instruments hardware (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit known at this time, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low-level privileges, limiting the practical attack surface (Feedly).

Patches have been released for all affected stable kernel branches. Users should update to the following fixed versions or later: 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34, 6.15.3, or 6.16-rc1. Distribution-specific updates are available from Red Hat, Debian (DSA-5973-1, DLA-4327-1), Ubuntu (USN-7769-2, USN-7770-1, USN-7771-1, USN-7774-2, USN-7775-1/2/3, USN-7789-1/2), SUSE, and openSUSE. As a temporary workaround where patching is not immediately possible, restricting local user access and monitoring memory allocation behavior can reduce risk (Red Hat CVE, Ubuntu Security, Debian LTS).