Linux Kernel Vulnerability in OCP Protocol Signal Handling

CVE-2025-38054

What is CVE-2025-38054?

A vulnerability in the Linux kernel's implementation of the OCP protocol allows for exploitable conditions due to uninitialized elements being accessed in signal and frequency output arrays. This can lead to NULL pointer dereferences, resulting in kernel crashes (page_fault_oops). To mitigate this risk, a recent patch has been introduced that limits the number of initialized elements within the freq_in[] and signal_out[] arrays to four, along with adjustments to the summary output functions to guard against out-of-bounds access. This ensures safe array handling and stabilizes kernel operations, enhancing overall system security.

References