CVE-2025-38664

What it actually does

Null pointer dereference occurs in ice_copy_and_init_pkg() when devm_kmemdup() returns NULL and the pointer is subsequently used without validation, leading to kernel memory corruption.

Why it matters to the business

Systems using affected Intel networking drivers may experience kernel crashes or instability, disrupting network operations and requiring reboots on servers or appliances with high downstream package prevalence.

How an attack unfolds

An attacker triggers memory allocation failure during package initialization in the ice driver (possibly via resource exhaustion or specific device interactions) to cause the unchecked NULL return from devm_kmemdup() to be dereferenced, though low EPSS and absence from KEV indicate limited in-the-wild exploitation despite mentions of related Linux privilege escalation campaigns.

How to fix it

Upgrade affected packages to the fixed versions: corretto-23 and related variants to 23.0.2.7.1-r7, and Linux kernel to commit 35370d3b44efe194fd5ad55bac987e629597d782 or later stable releases containing the devm_kmemdup() return value check.

How to confirm the fix worked

Verify kernel source or package versions match the listed fixed commits or Chainguard releases; inspect ice_copy_and_init_pkg() for the added NULL check on devm_kmemdup(); test driver initialization under low-memory conditions.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions with the ice driver enabled
2. Trigger conditions that cause devm_kmemdup() to fail allocation
3. Cause the function to dereference the NULL pointer leading to crash or corruption
4. Potentially chain with other kernel flaws for escalation if memory state is manipulated

How to detect it

Review kernel logs for oops or panic messages referencing ice_copy_and_init_pkg or devm_kmemdup; search system audit logs and dmesg for allocation failures around driver init; correlate with any VMSCAPE or container privilege escalation attempts on Linux systems.

What your security team should do

• Prioritize patching Linux kernel and Chainguard Corretto packages within maintenance windows given 431 days since publication
• Monitor EPSS trend and any new threat actor activity around related kernel CVEs
• Apply defense-in-depth such as memory limits and driver unloading where ice hardware is not required