CVE-2025-38007

What it actually does

Missing NULL check after devm_kasprintf() in uclogic_input_configured() allows a NULL pointer dereference when memory allocation fails, resulting in a kernel crash.

Why it matters to the business

Local users or attached hardware can trigger denial of service on systems running the affected kernel code, causing unexpected reboots or service interruptions; the issue has been public for over a year with minimal exploitation signals and no known ransomware use.

How an attack unfolds

An attacker with local access crafts input that causes the uclogic driver to call devm_kasprintf() under memory pressure; the missing check lets the NULL return value be dereferenced, crashing the kernel. No named threat actors have been observed exploiting this specific flaw despite other kernel privilege-escalation campaigns targeting similar components.

How to fix it

Update the Linux kernel to a version containing the NULL check after devm_kasprintf() in the uclogic driver; apply the fix referenced in commit cdb6c90811caa5df2df856be9b0b16db020fe31d for any affected openssh-portable builds that incorporate the driver change.

How to confirm the fix worked

Confirm the presence of the NULL pointer check immediately after the devm_kasprintf() call in uclogic_input_configured(); test by inducing low-memory conditions while attaching compatible HID devices and verify the system no longer crashes.

Typical attack path

1. Obtain local user access on a Linux system using the uclogic HID driver
2. Trigger memory allocation failure during input device configuration
3. Cause uclogic_input_configured() to dereference the NULL pointer returned by devm_kasprintf()
4. Crash the kernel resulting in denial of service

How to detect it

Review kernel logs for NULL pointer dereference oops messages originating from the uclogic driver; examine dmesg and syslog around device attach events for crashes in uclogic_input_configured().

What your security team should do

• Prioritize kernel updates on all systems exposing the uclogic HID driver within the next patch cycle
• Monitor EPSS and threat actor activity for any increase in related Linux kernel memory corruption issues
• Restrict untrusted local users and hardware from systems until patched