CVE-2025-38275

What it actually does

The qmp_usb_iomap() helper returns raw devm_ioremap() result without NULL check; only IS_ERR() is performed by callers, allowing NULL to pass through and cause subsequent invalid pointer dereference in the Qualcomm QMP USB PHY driver.

Why it matters to the business

Affected Linux kernel deployments on Qualcomm USB hardware face risk of kernel instability or crashes during PHY initialization, impacting USB device functionality across servers, embedded systems, and Alpaquita linux-lts environments with moderate ecosystem prevalence.

How an attack unfolds

An attacker triggers USB PHY driver load or reinitialization under conditions where devm_ioremap() fails and returns NULL; the missing NULL check allows the pointer to be dereferenced, resulting in memory corruption or kernel panic. Low EPSS and absence from KEV indicate limited in-the-wild exploitation despite listed threat actor interest in related Linux kernel issues.

How to fix it

Upgrade linux-lts (Alpaquita:stream) to 6.6.58-r0, linux-lts (Alpaquita:23) to 6.1.62-r0, or apply commit 0b979a409e40457ca1b5cb48755d1f34eee58805 from the stable Linux git tree; rebuild and reboot affected kernels.

How to confirm the fix worked

Confirm running kernel version matches or exceeds listed fixed versions; inspect qmp_usb_iomap() source to verify addition of NULL-to-IOMEM_ERR_PTR(-ENOMEM) conversion before IS_ERR() check.

Typical attack path

1. Gain local access or trigger USB PHY initialization path
2. Force devm_ioremap() to return NULL via resource exhaustion or mapping failure
3. Bypass existing IS_ERR() validation in qmp_usb_iomap()
4. Perform invalid dereference leading to crash or corruption

How to detect it

Review kernel logs for oops/panic entries mentioning qcom-qmp-usb, qmp_usb_iomap, or NULL pointer dereference during USB PHY probe; correlate with device mapper failures.

• qmp_usb_iomap
• devm_ioremap.*NULL
• IOMEM_ERR_PTR
• qcom-qmp-usb.*oops

What your security team should do

• Apply the exact fixed linux-lts package versions immediately on all affected systems
• Prioritize testing USB PHY functionality after upgrade due to kernel impact
• Monitor EPSS trend and kernel mailing lists for related privilege-escalation reports
• Schedule regular kernel updates given ecosystem prevalence of linux-lts