CVE-2025-38143

What it actually does

Missing NULL check after devm_kasprintf() in wled_configure() allows NULL pointer dereference when memory allocation fails.

Why it matters to the business

Kernel crashes or instability on affected Linux systems can disrupt operations and require reboots, with higher urgency for organizations running downstream packages like steampipe that depend on the kernel fix.

How an attack unfolds

An attacker with local access triggers wled_configure() under memory pressure so that devm_kasprintf() returns NULL; the subsequent dereference without a check leads to a crash, which threat actors listed in campaigns such as Advanced Spyware Campaign or various Linux Kernel Privilege Escalation efforts could chain for denial of service or further escalation.

How to fix it

Update to fixed versions: steampipe (Chainguard) 2.0.1-r0, steampipe (Wolfi) 2.0.1-r0, or Linux kernel commit 6a56446595730a5e3f06a30902e23cb037d28146 and later; apply the NULL check patch immediately given the 481 days since publication.

How to confirm the fix worked

Confirm the presence of the NULL check after devm_kasprintf() in wled_configure() by inspecting the source or verifying the kernel build contains commit 6a56446595730a5e3f06a30902e23cb037d28146; test under simulated low-memory conditions.

Typical attack path

1. Obtain local access or execute code on target Linux system
2. Induce memory allocation failure while backlight pm8941 wled_configure path executes
3. Trigger NULL dereference to cause kernel panic or instability
4. Attempt to leverage resulting state for privilege escalation or persistence

How to detect it

Review kernel logs for NULL pointer dereference faults in the pm8941 backlight or wled_configure path; correlate with low-memory events or attempts by listed threat actors to trigger similar kernel issues.

What your security team should do

• Prioritize patching all affected Linux kernel instances and dependent packages such as steampipe to the listed fixed versions
• Monitor EPSS trend and related privilege-escalation campaigns for any increase in activity
• Harden systems against local memory-exhaustion attacks as a defense-in-depth measure