Cyber Resilience

CVE-2025-38319

Memory Safety in Linux Kernel 4.18 – 5.15.186

Published
10 July 2025
Modified
17 June 2026
Patch / advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0014 4th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-38319 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-11 (Error Handling) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table The function atomctrl_initialize_mc_reg_table() and atomctrl_initialize_mc_reg_table_v2_2() does not check the return value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to retrieve vram_info, it returns NULL…

more

which is later dereferenced.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-38020Same product: Debian Debian Linux
CVE-2025-38364Same product: Debian Debian Linux
CVE-2025-37844Same product: Debian Debian Linux
CVE-2025-38304Same product: Debian Debian Linux
CVE-2025-38683Same product: Debian Debian Linux
CVE-2024-26744Same product: Debian Debian Linux
CVE-2025-37958Same product: Debian Debian Linux
CVE-2025-38634Same product: Debian Debian Linux
CVE-2025-38569Same product: Debian Debian Linux
CVE-2023-52686Same product: Debian Debian Linux

Affected Assets

linux
linux kernel
4.18 — 5.15.186 · 5.16 — 6.1.142 · 6.2 — 6.6.94
debian
debian linux
11.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-11 Error Handling
  • SI-10 Information Input Validation
  • SI-16 Memory Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires proper error handling so that a NULL return from smu_atom_get_data_table() is checked before any dereference in atomctrl_initialize_mc_reg_table().

prevent

Mandates validation of all input values (including function return pointers) before use, preventing the NULL dereference path described in the CVE.

prevent

Provides memory-protection mechanisms that can detect and block invalid pointer dereferences at runtime, limiting exploitability of the unchecked NULL.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (static analysis, code review, safe coding standards) directly prevent NULL dereference bugs during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect NULL dereference defects before release.

prevents

Secure SDLC mandates defensive coding practices that can prevent NULL dereferences.

prevents

Application security requirements can specify input validation and pointer-safety rules.

prevents

Secure architecture principles encourage defensive design that avoids unsafe pointer use.

prevents

Secure coding standards directly require NULL-pointer checks and safe dereference patterns.

References