CVE-2025-38160 in Linux
Summary
by MITRE • 07/03/2025
In the Linux kernel, the following vulnerability has been resolved:
clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
devm_kasprintf() returns NULL when memory allocation fails. Currently, raspberrypi_clk_register() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devm_kasprintf() to prevent this issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/18/2026
The vulnerability CVE-2025-38160 represents a critical null pointer dereference flaw within the Linux kernel's clock management subsystem, specifically affecting the Broadcom Raspberry Pi clock driver implementation. This issue resides in the raspberrypi_clk_register() function where the kernel fails to properly validate memory allocation outcomes from the devm_kasprintf() API call. The root cause stems from the assumption that memory allocation operations will always succeed, creating a dangerous condition where a null pointer is dereferenced when the kernel attempts to process clock registration requests on Raspberry Pi platforms. The vulnerability directly impacts the kernel's ability to manage clock sources and can lead to system instability or complete system crashes during normal operation.
The technical implementation flaw occurs when the devm_kasprintf() function encounters memory allocation failure during dynamic string construction for clock device naming. This function returns NULL when memory allocation cannot be fulfilled, but the raspberrypi_clk_register() function does not perform proper null pointer validation before proceeding with subsequent operations. This pattern violates fundamental kernel programming practices and creates an exploitable condition where malicious actors or system errors can trigger the null pointer dereference. The vulnerability falls under CWE-476, specifically addressing null pointer dereference issues, and demonstrates poor error handling in kernel space memory management operations.
The operational impact of this vulnerability extends beyond simple system crashes to potentially compromise the entire Raspberry Pi platform's reliability and stability. When the null pointer dereference occurs, the kernel experiences a segmentation fault that typically results in immediate system termination or reboot, disrupting ongoing processes and potentially causing data loss. This is particularly concerning for embedded systems and IoT deployments where Raspberry Pi devices operate continuously without user intervention. The vulnerability affects all Raspberry Pi models that utilize the Broadcom clock driver implementation, making it a widespread concern across the Linux kernel ecosystem for ARM-based embedded systems.
The mitigation strategy for CVE-2025-38160 involves implementing a straightforward but critical null pointer validation check immediately following the devm_kasprintf() call within the raspberrypi_clk_register() function. This remediation aligns with established kernel security practices and follows the principle of defensive programming where all memory allocation operations must be validated before use. The fix ensures that when memory allocation fails, the function gracefully handles the error condition rather than proceeding with null pointer operations. This approach aligns with the ATT&CK technique T1499.004 for avoiding detection through proper error handling and demonstrates the importance of memory safety in kernel space operations. System administrators should prioritize applying this patch across all Raspberry Pi deployments to prevent potential system instability and maintain operational continuity in critical embedded environments.