CVE-2025-38487
BaseFortify
Publication date: 2025-07-28
Last updated on: 2025-11-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| aspeed | lpc-snoop | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's aspeed LPC-snoop driver occurs because the code disables channels that are not enabled, leading to a kernel NULL pointer dereference and an internal error (kernel Oops). This can cause the system to crash or become unstable when certain operations, such as unbinding the driver, are performed.
How can this vulnerability impact me? :
The vulnerability can cause the Linux kernel to crash or become unstable due to a NULL pointer dereference, potentially leading to denial of service or system instability when interacting with the aspeed LPC-snoop driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for specific error messages related to the aspeed-lpc-snoop driver. Look for kernel NULL pointer dereference errors and internal kernel oops messages similar to: [ 120.363594] Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write [ 120.373866] [00000004] *pgd=00000000 [ 120.377910] Internal error: Oops: 805 [#1] SMP ARM You can check kernel logs using the command: dmesg | grep -i lpc-snoop or journalctl -k | grep -i lpc-snoop These commands help identify if the vulnerable driver is causing kernel errors.
What immediate steps should I take to mitigate this vulnerability?
An immediate mitigation step is to unbind the vulnerable aspeed-lpc-snoop driver from the platform device by running: echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind This disables the vulnerable driver and prevents the kernel NULL pointer dereference from occurring.