CVE-2025-38210 configfs-tsm-report: Fix NULL dereference of tsm_ops
A missing check in the Linux kernel configfs-tsm-report module allows a local attacker to trigger a NULL pointer dereference, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38210?
CVE-2025-38210 is a medium-severity vulnerability in Linux kernel, published on 4 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
configfs-tsm-report: Fix NULL dereference of tsm_ops
Unlike sysfs, the lifetime of configfs objects is controlled by userspace. There is no mechanism for the kernel to find and delete all created config-items. Instead, the configfs-tsm-report mechanism has an expectation that tsm_unregister() can happen at any time and cause established config-item access to start failing.
That expectation is not fully satisfied. While tsm_report_read(), tsm_report_{is,is_bin}_visible(), and tsm_report_make_item() safely fail if tsm_ops have been unregistered, tsm_report_privlevel_store() tsm_report_provider_show() fail to check for ops registration. Add the missing checks for tsm_ops having been removed.
Now, in supporting the ability for tsm_unregister() to always succeed, it leaves the problem of what to do with lingering config-items. The expectation is that the admin that arranges for the ->remove() (unbind) of the ${tsm_arch}-guest driver is also responsible for deletion of all open config-items. Until that deletion happens, ->probe() (reload / bind) of the ${tsm_arch}-guest driver fails.
This allows for emergency shutdown / revocation of attestation interfaces, and requires coordinated restart.
Weakness: CWE-476
Which versions are affected by CVE-2025-38210?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38210?
Apply the vendor's patch.
Is CVE-2025-38210 being exploited?
There is no known exploitation of CVE-2025-38210 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38210, DEBIAN-CVE-2025-38210, GHSA-x738-fp96-2h57, ROOT-OS-UBUNTU-2404-CVE-2025-38210, UBUNTU-CVE-2025-38210.