CVE-2025-38629

Medium

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: scarlett2: Fix missing NULL check scarlett2_input_select_ctl_info() sets up the string arrays allocated via kasprintf(), but it misses NULL checks, which may lead to NULL dereference Oops. Let's add the proper NULL check.

SeverityMedium

CVSS5.5

Exploit probability6. percentile0.2%

Product

Linux Kernel

PublishedAug 22, 2025

First seenAug 22, 2025

Weakness typeCWE-476NULL pointer dereference

How to fix

Update

linux linux_kernel6.15.10, 6.16.1 or later

Patches

git.kernel.org/stable/c/2c735fcaee81ad8056960659dc9dc460891e76b0
git.kernel.org/stable/c/d558db85920b124bac36f8a7ddc5de0aa7491bdd
git.kernel.org/stable/c/df485a4b2b3ee5b35c80f990beb554e38a8a5fb1

Affected products

Product	Affected versions	Fixed in
linux linux_kernel	6.13 ≤ v < 6.15.10, 6.16 ≤ v < 6.16.1	6.15.10, 6.16.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.