CVE-2025-38274

What it actually does

Unchecked kunit_kzalloc failure in fpga_mgr_test_img_load_sgt passes NULL to sg_alloc_table which performs memset on it, resulting in a NULL pointer dereference.

Why it matters to the business

Kernel crash or panic possible on systems running FPGA-related kunit tests under memory pressure; limited operational impact outside development and testing environments.

How an attack unfolds

An attacker with local access forces low-memory conditions then invokes the affected kunit test path, causing the allocation to fail and the subsequent memset to dereference NULL.

How to fix it

Upgrade linux-lts (Alpaquita) to 6.1.56-r0 or apply commit e69e2cfd8b38d9463a250e153ef4963a604d61e9 from the stable git tree.

How to confirm the fix worked

Verify kernel version matches fixed release or confirm presence of KUNIT_ASSERT_NOT_ERR_OR_NULL check in fpga_mgr_test_img_load_sgt source.

Typical attack path

1. Obtain local execution on a vulnerable kernel build with kunit enabled
2. Trigger memory exhaustion to force kunit_kzalloc failure
3. Invoke fpga_mgr_test_img_load_sgt via the test harness
4. sg_alloc_table receives NULL and calls memset triggering dereference

How to detect it

Inspect kernel logs for oops or panic messages referencing fpga_mgr_test_img_load_sgt or sg_alloc_table under memory-pressure conditions.

• fpga_mgr_test_img_load_sgt
• kunit_kzalloc
• sg_alloc_table
• NULL pointer dereference

What your security team should do

• Apply the listed kernel updates to all affected Alpaquita and stable builds
• Disable kunit tests in production kernel configurations
• Monitor for kernel oops involving fpga_mgr_test_img_load_sgt