Null Pointer Dereference in Linux Kernel's Backlight Configuration by Vendor

CVE-2025-38143

What is CVE-2025-38143?

The vulnerability stems from the absence of a NULL check in the 'wled_configure()' function of the Linux kernel's backlight subsystem. When memory allocation via 'devm_kasprintf()' fails, a NULL pointer dereference occurs, potentially leading to system crashes or unpredictable behavior. The recent patch implements a necessary NULL check to enhance robustness and prevent these critical errors, ensuring smoother operation of backlight features in supported devices.

References