CVE-2025-38634

What it actually does

Missing null check after power_supply_get_by_name() in cpcap_usb_detect() allows NULL pointer dereference, resulting in kernel memory corruption or crash.

Why it matters to the business

Systems using affected Linux kernels with the cpcap charger driver may experience unexpected kernel panics or instability, especially during USB power events; older kernels increase exposure window.

How an attack unfolds

An attacker with local access or the ability to trigger USB detection events on hardware using the cpcap charger causes power_supply_get_by_name to return NULL; the subsequent dereference without a check leads to kernel fault. Related privilege-escalation campaigns targeting Container-Optimized OS have exploited similar kernel paths.

How to fix it

Update Linux kernel to commit 4ebbb9106aaa2fd58e0359bc3a2490953db2ef0c or later; for Chainguard packages update openjdk-17-openj9* to 0.53.0-r0.

How to confirm the fix worked

Confirm kernel source contains the added NULL check after power_supply_get_by_name in cpcap-charger.c; verify running kernel version includes the fix commit or package version 0.53.0-r0.

Typical attack path

1. Gain local execution context on affected Linux system
2. Trigger cpcap_usb_detect via USB insertion or power supply events
3. Force power_supply_get_by_name to return NULL
4. Trigger NULL dereference to induce kernel crash or corruption

How to detect it

Review kernel logs for oops/panic traces mentioning cpcap_usb_detect or power_supply_get_by_name; search audit and dmesg for USB power events preceding crashes.

What your security team should do

• Prioritize kernel upgrade on all systems exposing the cpcap charger driver
• Monitor for kernel oops or panic logs related to cpcap_usb_detect
• Apply updates before the CISA-style deadlines referenced in similar kernel issues
• Restrict untrusted local access on high-value systems until patched