CVE-2025-38648

What it actually does

Potential NULL pointer dereference in stm32_spi_probe when of_device_get_match_data returns NULL before accessing cfg->has_device_mode, leading to kernel crash on affected STM32 SPI hardware.

Why it matters to the business

Unexpected system crashes and downtime on Linux devices using STM32 SPI controllers, increasing operational risk for embedded and industrial systems until patched.

How an attack unfolds

An attacker triggers the stm32_spi driver probe on a system lacking proper device tree match data, causing the unchecked cfg pointer to be dereferenced and resulting in a kernel panic or denial of service.

How to fix it

Update the Linux kernel to commit 6031a54f4eac921efe6122a561d44df89b37f2d4 or later, and apply package fixes such as openjdk-11-openj9 0.53.0-r0 on Chainguard systems.

How to confirm the fix worked

Confirm the NULL check for cfg before accessing has_device_mode is present in stm32_spi_probe source, or verify the running kernel includes the listed commit hash.

Typical attack path

1. Identify or prepare a Linux system using the stm32 SPI driver
2. Manipulate device tree or match data to cause of_device_get_match_data to return NULL
3. Load or trigger stm32_spi_probe during device initialization
4. Trigger NULL dereference leading to kernel crash

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing stm32_spi_probe or NULL pointer dereferences during SPI device initialization.

What your security team should do

• Prioritize kernel updates on all affected Linux systems within 30 days
• Audit device trees for STM32 SPI configurations to ensure match data is complete
• Monitor kernel logs for NULL pointer dereference panics involving stm32_spi
• Test updates in staging environments before production rollout