NULL Pointer Dereference Vulnerability in Linux Kernel Affects STM32 SPI Driver

CVE-2025-38648

What is CVE-2025-38648?

A vulnerability in the Linux Kernel's STM32 SPI driver has been addressed where the stm32_spi_probe function did not verify if a critical pointer was NULL before using it. This oversight could lead to a potential system crash due to a NULL pointer dereference when accessing the has_device_mode member of the configuration structure. The fix ensures that an error is logged if the configuration data is unavailable, thus enhancing system stability by preventing runtime crashes.

References