What’s Vulnerable › Vulnerabilities

CVE-2025-38007: HID: uclogic: Add NULL check in uclogic_input_configured()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-18 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Add NULL check in uclogic_input_configured() devm_kasprintf() returns NULL when memory allocation fails. Currently, uclogic_input_configured() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 6.1.53 before 6.1.140; from 6.4.16 before 6.5; from 6.5.3 before 6.6.92; from 6.7 before 6.12.30; from 6.13 before 6.14.8; 6.15-rc1, 6.15-rc2, 6.15-rc3, 6.15-rc4, 6.15-rc5, 6.15-rc6 — fixed in 6.1.140, 6.12.30, 6.14.8, 6.5, 6.6.92

How to fix

Upgrade to a fixed version: Linux kernel 6.1.140, 6.12.30, 6.14.8, 6.5. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/00d52b2fa6083dd0f5c44f3604cd1bad1f9177dc
• https://git.kernel.org/stable/c/01b76cc8ca243fc3376b035aa326bbc4f03d384b
• https://git.kernel.org/stable/c/94e7272b636a0677082e0604609e4c471e0a2caf
• https://git.kernel.org/stable/c/a9f58479a1a2c6f72907679c4df2f4ed92b05b39
• https://git.kernel.org/stable/c/ad6caaf29bc26a48b1241ce82561fcbcf0a75aa9
• https://git.kernel.org/stable/c/b616453d719ee1b8bf2ea6f6cc6c6258a572a590
• https://git.kernel.org/stable/c/bd07f751208ba190f9b0db5e5b7f35d5bb4a8a1e
• https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html

Get alerted when CVE-2025-38007 or the next vulnerability affects your stack