5.5

CVE-2025-38668: debian debian_linux NULL Pointer Dereference

CVSS: 5.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-38668DEBIAN-CVE-2025-38668
Published 22-08-2025Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2025-38668 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.2% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 50 · Related 48
DLA-4327-1DLA-4328-1OPENSUSE-SU-2025:20081-1SUSE-SU-2025:03290-1SUSE-SU-2025:03382-1SUSE-SU-2025:03600-1

Timeline

  1. 22-08-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix NULL dereference on unbind due to stale coupling data Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can lead to NULL pointer dereference when regulators are accessed post-unbind. This can happen during runtime PM or other regulator operations that rely on coupling metadata. For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers a panic in regulator_lock_recursive() due to stale coupling state. Ensure n_coupled is set to 0 to prevent access to invalid pointers.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

0.00 pp

From 0.16% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu148 products
  • linuxAll versions (No fix recorded) | < 5.15.0-163.173 | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1097.104 | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.148-1 | < 6.12.41-1 | < 6.16.3-1
  • debian_linuxEOL11.0
Linux2 products
  • linux≥ d8ca7d184b33af7913c244900df77c6cad6a5590, < 7574892e259bbb16262ebfb4b65a2054a5e03a49 | ≥ d8ca7d184b33af7913c244900df77c6cad6a5590, < 6c49eac796681e250e34156bafb643930310bd4a | ≥ d8ca7d184b33af7913c244900df77c6cad6a5590, < ca9bef9ba1a6be640c87bf802d2e9e696021576a | ≥ d8ca7d184b33af7913c244900df77c6cad6a5590, < 800a2cfb2df7f96b3fb48910fc595e0215f6b019 | ≥ d8ca7d184b33af7913c244900df77c6cad6a5590, < 233d3c54c9620e95193923859ea1d0b0f5d748ca | ≥ d8ca7d184b33af7913c244900df77c6cad6a5590, < 5d4261dbb3335221fd9c6e69f909ba79ee6663a7 | ≥ d8ca7d184b33af7913c244900df77c6cad6a5590, < d7e59c5fd7a0f5e16e75a30a89ea2c4ab88612b8 | ≥ d8ca7d184b33af7913c244900df77c6cad6a5590, < ca46946a482238b0cdea459fb82fc837fb36260e | 5.3
  • linux_kernel≥ 5.3, < 5.4.297 | ≥ 5.5, < 5.10.241 | ≥ 5.11, < 5.15.190 | ≥ 5.16, < 6.1.148 | ≥ 6.2, < 6.6.101 | ≥ 6.7, < 6.12.41 | ≥ 6.13, < 6.15.9 | 6.16:rc1 | 6.16:rc2 | 6.16:rc3 | 6.16:rc4

3 vendors · 152 products

References

46 links
Show all 46 references