CVE-2025-38602

What it actually does

Missing NULL check on alloc_ordered_workqueue return value allows dereference of a NULL pointer, resulting in kernel memory corruption or panic.

Why it matters to the business

Linux systems may experience unexpected crashes, degraded performance, or potential privilege escalation, disrupting operations and increasing risk on affected kernels.

How an attack unfolds

An attacker triggers the code path that calls alloc_ordered_workqueue under memory pressure or specific conditions so the allocation fails and returns NULL; subsequent use of the pointer leads to corruption or control-flow hijack.

How to fix it

Update the Linux kernel to commit c80832d445653baba5ac80cd2c2637c437ac881b or later; for Chainguard packages apply openjdk-8-openj9 0.53.0-r1 or newer.

How to confirm the fix worked

Verify the presence of the check after alloc_ordered_workqueue in the iwlwifi source and confirm the running kernel contains commit c80832d445653baba5ac80cd2c2637c437ac881b.

Typical attack path

1. Identify a workload or input that reaches the iwlwifi workqueue allocation site
2. Exhaust memory or force allocation failure to obtain a NULL pointer
3. Trigger dereference of the unchecked pointer to corrupt kernel memory or panic the system
4. Leverage resulting corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for NULL pointer dereference oops messages near iwlwifi workqueue allocation; correlate with container or VM workloads that could starve memory.

What your security team should do

• Prioritize kernel updates on all Linux hosts within the next patch cycle
• Monitor EPSS trend and re-evaluate if exploitation maturity increases
• Restrict untrusted workloads that could trigger memory pressure in network drivers