What’s Vulnerable › Vulnerabilities

CVE-2025-38629: ALSA: usb: scarlett2: Fix missing NULL check

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-22 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: scarlett2: Fix missing NULL check scarlett2_input_select_ctl_info() sets up the string arrays allocated via kasprintf(), but it misses NULL checks, which may lead to NULL dereference Oops. Let's add the proper NULL check.

Affected products

• Linux kernel: from 6.13 before 6.15.10; from 6.16 before 6.16.1 — fixed in 6.15.10, 6.16.1

How to fix

Upgrade to a fixed version: Linux kernel 6.15.10, 6.16.1. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2c735fcaee81ad8056960659dc9dc460891e76b0
• https://git.kernel.org/stable/c/d558db85920b124bac36f8a7ddc5de0aa7491bdd
• https://git.kernel.org/stable/c/df485a4b2b3ee5b35c80f990beb554e38a8a5fb1

Get alerted when CVE-2025-38629 or the next vulnerability affects your stack