CVE-2025-38138

What it actually does

Missing NULL check after devm_kasprintf() in udma_probe() allows NULL pointer dereference on memory allocation failure, resulting in kernel crash or undefined behavior in the TI UDMA driver.

Why it matters to the business

Affected Linux systems using the TI DMA engine may experience unexpected kernel panics during device initialization under low-memory conditions, leading to downtime on servers, embedded devices, and container hosts that include the vulnerable kernel code; low EPSS and absence from KEV indicate limited real-world exploitation urgency despite the kernel's broad prevalence.

How an attack unfolds

An attacker with local access triggers a memory pressure condition during udma_probe() execution so that devm_kasprintf() returns NULL; the subsequent dereference of the unchecked pointer causes a kernel oops or panic, providing denial of service; listed threat actors associated with other Linux kernel privilege-escalation CVEs illustrate ongoing interest in similar kernel flaws but no public exploitation of this specific issue is recorded.

How to fix it

Update to fixed kernel commit ec1ea394c40523835bbedd8fc4934b77b461b6fe or later; for Chainguard packages upgrade beats-9, auditbeat-9, filebeat-9, heartbeat-9, and metricbeat-9 to version 9.0.2-r1 or newer; rebuild and reboot systems with the patched kernel; where immediate patching is not possible, limit local untrusted code execution and monitor for allocation failures during device initialization.

How to confirm the fix worked

Confirm the presence of the NULL check immediately after the devm_kasprintf() call in udma_probe(); verify the running kernel contains commit ec1ea394c40523835bbedd8fc4934b77b461b6fe or the Chainguard package versions listed above; test device probe under simulated memory pressure to ensure no dereference occurs.

Typical attack path

1. Obtain local code execution or shell on target system
2. Induce memory exhaustion or allocation failure during DMA controller probe
3. Trigger udma_probe() path so devm_kasprintf() returns NULL
4. Cause NULL pointer dereference leading to kernel panic or crash

How to detect it

Review kernel logs for oops or panic messages originating from udma_probe() or ti_udma; correlate crashes with low-memory conditions during DMA device initialization; no specific post-exploitation artifacts are expected because the flaw is a defensive NULL check addition rather than a remotely triggerable remote code path.

What your security team should do

• Prioritize kernel updates on all systems shipping the vulnerable TI UDMA driver code
• Apply the exact fixed versions (9.0.2-r1 for Chainguard beats packages and commit ec1ea394c40523835bbedd8fc4934b77b461b6fe for mainline) within standard change windows given low EPSS
• Restrict local user code execution on high-value systems until patched
• Incorporate kernel NULL-dereference crash signatures into existing monitoring