CVE-2025-38581

What it actually does

NULL pointer dereference in ccp5_debugfs_setup during device rebind when CONFIG_CRYPTO_DEV_CCP_DEBUGFS is enabled, triggered because ccp_debugfs_dir is not reset to NULL after debugfs directory destruction.

Why it matters to the business

Systems using AMD CCP crypto hardware can experience kernel crashes and reboots during device driver reload or PCI device rebind operations, leading to unplanned downtime and potential loss of cryptographic acceleration services.

How an attack unfolds

An attacker with sufficient privileges to write to PCI driver sysfs attributes performs unbind followed by bind on the CCP device; the missing NULL reset causes debugfs_create_dir to dereference a freed or invalid pointer, resulting in an immediate kernel oops.

How to fix it

Update the Linux kernel to the fixed commit a25ab6dfa0ce323ec308966988be6b675eb9d3e5 or later stable release containing the ccp_debugfs_dir = NULL assignment after ccp5_debugfs_destroy; rebuild and deploy the kernel package containing this change.

How to confirm the fix worked

After applying the update, repeat the unbind/bind sequence on the CCP device and confirm no kernel NULL pointer oops occurs; verify the presence of the commit in the running kernel source or package changelog.

Typical attack path

1. Identify system with CONFIG_CRYPTO_DEV_CCP_DEBUGFS enabled and CCP PCI device present
2. Write PCI address to /sys/bus/pci/drivers/ccp/unbind
3. Write same PCI address to /sys/bus/pci/drivers/ccp/bind
4. Kernel executes ccp5_init path that calls ccp5_debugfs_setup without valid directory pointer
5. Trigger NULL pointer write and kernel panic

How to detect it

Search kernel logs and dmesg for BUG: kernel NULL pointer dereference combined with call traces containing ccp5_debugfs_setup, ccp5_init, or debugfs_create_dir during PCI bind operations; correlate with sysfs writes to ccp driver unbind/bind attributes.

• BUG: kernel NULL pointer dereference.*ccp
• ccp5_debugfs_setup+0x87/0x170
• echo.*ccp/unbind
• echo.*ccp/bind

What your security team should do

• Prioritize kernel upgrade on all systems exposing CCP devices with debugfs crypto support enabled
• Disable CONFIG_CRYPTO_DEV_CCP_DEBUGFS at build time where the feature is not required
• Monitor kernel logs for ccp-related oops messages on systems that cannot be immediately updated