5.5

CVE-2025-37881: usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()

Analyzed
AliasesUBUNTU-CVE-2025-37881DEBIAN-CVE-2025-37881
Published 09-05-2025Last modified 11-05-2026

Vulnerability summary

CVE-2025-37881 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.31%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 44 · Related 40
DLA-4178-1DLA-4193-1MGASA-2025-0182MGASA-2025-0183SUSE-SU-2025:01964-1SUSE-SU-2025:01965-1

Timeline

  1. 09-05-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() The variable d->name, returned by devm_kasprintf(), could be NULL. A pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in commit 3027e7b15b02 ("ice: Fix some null pointer dereference issues in ice_ptp.c"). This issue is found by our static analysis tool

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

24%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.30% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu141 products
  • linuxAll versions (No fix recorded) | < 5.15.0-144.157 | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1088.95 | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ 7ecca2a4080cb6b1fa174adc588fce9e9014c43c, < a777ccfb9ba8d43f745e41b69ba39d4a506a081e | ≥ 7ecca2a4080cb6b1fa174adc588fce9e9014c43c, < c8d4faf452a627f9b09c3a5c366133a19e5b7a28 | ≥ 7ecca2a4080cb6b1fa174adc588fce9e9014c43c, < d26a6093d52904cacdbb75424c323c19b443a890 | ≥ 7ecca2a4080cb6b1fa174adc588fce9e9014c43c, < 36d68151712e525450f0fbb3045e7110f0d9b610 | ≥ 7ecca2a4080cb6b1fa174adc588fce9e9014c43c, < cfa7984f69359761b07a7831c1258c0fde1e0389 | ≥ 7ecca2a4080cb6b1fa174adc588fce9e9014c43c, < 052fb65335befeae8500e88d69ea022266baaf6d | ≥ 7ecca2a4080cb6b1fa174adc588fce9e9014c43c, < 61006ca381b4d65d2b8ca695ea8da1ce18d6dee3 | ≥ 7ecca2a4080cb6b1fa174adc588fce9e9014c43c, < 8c75f3e6a433d92084ad4e78b029ae680865420f | 4.18
  • linux_kernel≥ 4.18, < 5.4.293 | ≥ 5.5, < 5.10.237 | ≥ 5.11, < 5.15.181 | ≥ 5.16, < 6.1.136 | ≥ 6.2, < 6.6.89 | ≥ 6.7, < 6.12.26 | ≥ 6.13, < 6.14.5

3 vendors · 145 products

References

44 links
Show all 44 references