Null Pointer Dereference Vulnerability in Linux Kernel Affects Multiple Configurations

CVE-2025-38255

What is CVE-2025-38255?

A vulnerability in the Linux kernel's handling of CPU groups can lead to a null pointer dereference, triggered when the numgrps variable is set to zero during the operation of configfs. This flaw can cause the kernel to panic, resulting in system instability. The root cause is the dereferencing of a ZERO_SIZE_PTR returned by kcalloc() when it encounters a zero value. To mitigate this, a check has been implemented to ensure numgrps is greater than zero before proceeding, which prevents such panics and enhances system resilience.

References