Null Pointer Dereference in Linux Kernel Affecting Ice Networking Driver

CVE-2025-38664

What is CVE-2025-38664?

A vulnerability exists in the Ice networking driver of the Linux kernel due to a potential null pointer dereference in the function ice_copy_and_init_pkg(). The issue arises from a missing check on the return value of devm_kmemdup(), which can result in undefined behavior or crashes. This flaw could compromise system stability or lead to other unintended consequences if exploited. It's crucial for users and system administrators to apply the relevant updates to mitigate this risk.

References