CVE-2025-38274: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38274 is a vulnerability discovered in the Linux kernel's FPGA manager subsystem, specifically in the fpgamgrtestimgload_sgt() function. The vulnerability was disclosed on July 10, 2025 (NVD).

The vulnerability stems from a potential null pointer dereference in the fpgamgrtestimgloadsgt() function. The function allocates memory for sgt using kunitkzalloc() but fails to verify if the allocation was successful. When the allocation fails, the null sgt pointer is passed to sgalloctable(), which then passes it to _sgalloc_table(). The subsequent memset() operation on the null pointer can trigger a null pointer dereference (Debian Security).

The vulnerability could lead to a system crash due to the null pointer dereference, potentially causing a denial of service condition in affected Linux systems (NVD).

The vulnerability has been fixed by implementing a proper allocation check using KUNITASSERTNOTERROR_NULL(). Various Linux distributions have released patches, including Debian which has fixed versions available in multiple releases: bullseye (5.10.237-1), bookworm (6.1.140-1), and sid (6.12.38-1) (Debian Security).