CVE-2025-38541: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38541 is a vulnerability discovered in the Linux kernel affecting the WiFi subsystem, specifically in the mt76 driver's mt7925 component. The vulnerability was disclosed on August 16, 2025, and involves a null pointer dereference issue in the mt7925thermalinit() function (NVD, Debian).

The vulnerability occurs when devmkasprintf() returns NULL on error in the mt7925thermal_init() function. The function does not properly check for this NULL return value, which results in a NULL pointer dereference. This is a programming oversight where error handling was not properly implemented for memory allocation failures (NVD).

The vulnerability could lead to a system crash due to the NULL pointer dereference when initializing the thermal management component of the mt7925 WiFi driver. This primarily affects systems using the MediaTek MT7925 WiFi chipset (Debian).

The issue has been fixed by adding a NULL check after the devmkasprintf() call in the mt7925thermal_init() function. Various Linux distributions have released patches, with Debian marking it as fixed in version 6.16.3-1 for unstable releases and 6.12.41-1 for Trixie (Debian).