CVE-2025-38583

What it actually does

A missing check for successful registration of pll_post in the xilinx vcu clock provider leads to a NULL or ERR pointer being passed to clk_hw_unregister_fixed_factor, triggering a kernel NULL pointer dereference.

Why it matters to the business

Systems relying on the Xilinx VCU driver may crash during module initialization or probe, causing denial of service and potential loss of video processing capabilities on affected Linux kernels.

How an attack unfolds

An attacker triggers the xvcu driver probe in an environment where pll_post clock registration fails; the error path then calls unregister on an invalid pointer, resulting in a kernel panic. No widespread in-the-wild exploitation or ransomware use has been observed for this issue.

How to fix it

Update the Linux kernel to commit 7e903da71f8bec4beb7c06707900e1ed8db843ca or later. For Chainguard packages, upgrade openjdk-17-openj9 and related variants to version 0.53.0-r0. Rebuild and reboot systems after applying the fix.

How to confirm the fix worked

Confirm the presence of the registration-status check before the unregister call in xvcu_unregister_clock_provider; reproduce probe under simulated registration failure and verify absence of the NULL dereference oops.

Typical attack path

1. Load or trigger probe of the xlnx_vcu kernel module
2. Force a failure during pll_post clock registration
3. Allow the error-handling path in xvcu_unregister_clock_provider to execute
4. Induce kernel NULL pointer dereference and panic

How to detect it

Search kernel logs and dmesg for NULL pointer dereference at clk_hw_unregister combined with the call trace containing xvcu_unregister_clock_provider and xvcu_probe from the xlnx_vcu module.

• clk_hw_unregister+0xc/0x20
• clk_hw_unregister_fixed_factor+0x18/0x30
• xvcu_unregister_clock_provider+0xcc/0xf4 [xlnx_vcu]
• xvcu_probe+0x2bc/0x53c [xlnx_vcu]

What your security team should do

• Prioritize kernel updates on systems exposing the xlnx_vcu driver
• Test driver initialization paths in staging environments before production rollout
• Monitor kernel logs for related clock unregister traces during device bring-up