CVE-2025-38135

What it actually does

Missing NULL check after devm_ioremap() in mlb_usio_probe() allows a NULL pointer dereference during device probe in the Linux kernel serial driver.

Why it matters to the business

Systems using affected Linux kernel versions with MLB USIO serial hardware may experience kernel crashes or denial of service during device initialization; prevalence is limited to specific kernel builds and downstream packages such as karpenter-0.36.

How an attack unfolds

An attacker with local access triggers the mlb_usio_probe function under conditions where devm_ioremap fails (for example, resource exhaustion or malformed device tree), causing the kernel to dereference the unchecked NULL return value and panic; listed threat actors associated with similar Linux kernel privilege-escalation campaigns could chain this into broader attacks.

How to fix it

Update to fixed kernel commit a05ebe384c7ca75476453f3070c67d9cf1d1a89f or karpenter-0.36.9-r6; rebuild and deploy updated kernel packages across all affected systems.

How to confirm the fix worked

Confirm presence of the NULL check immediately after the devm_ioremap call in mlb_usio_probe; verify kernel version or package matches the listed fixed versions; run probe under simulated ioremap failure conditions to ensure no crash occurs.

Typical attack path

1. Gain local code execution on target system
2. Trigger loading or re-probing of the mlb_usio serial driver
3. Induce ioremap failure via resource contention or crafted hardware description
4. Kernel dereferences NULL pointer resulting in panic or potential memory corruption

How to detect it

Review kernel logs for oops or panic messages referencing mlb_usio_probe or devm_ioremap failures; search audit and dmesg records around device probe events for NULL pointer dereference signatures.

What your security team should do

• Prioritize patching systems that expose MLB USIO hardware or run the affected driver within 48 hours
• Monitor EPSS trend and similar kernel CVEs for rising exploit maturity
• Apply kernel updates via standard package management and reboot
• Audit device trees and driver load paths for unnecessary exposure of the serial device