Null Pointer Dereference in Linux Kernel USB Component

CVE-2025-38134

What is CVE-2025-38134?

A vulnerability exists within the USB subsystem of the Linux kernel that can lead to a null pointer dereference. Specifically, the function usb_hub_to_struct_hub() may return NULL under certain conditions, particularly during race conditions in hub driver unbinding or teardown scenarios, despite the usb_device structure being present. This could cause a critical failure in the kernel when subsequent attempts are made to access hub ports without proper null checks.

References