CVE-2025-38559 platform/x86/intel/pmt: fix a crashlog NULL pointer access
A local attacker can trigger a kernel crash via NULL pointer dereference in the Intel PMT driver when reading crashlog sysfs entries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38559?
CVE-2025-38559 is a medium-severity vulnerability in Linux kernel, published on 19 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
platform/x86/intel/pmt: fix a crashlog NULL pointer access
Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry endpoint usage.
Without the ep, the crashlog usage causes the following NULL pointer exception:
BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:intel_pmt_read+0x3b/0x70 [pmt_class] Code: Call Trace: <TASK> ? sysfs_kf_bin_read+0xc0/0xe0 kernfs_fop_read_iter+0xac/0x1a0 vfs_read+0x26d/0x350 ksys_read+0x6b/0xe0 __x64_sys_read+0x1d/0x30 x64_sys_call+0x1bc8/0x1d70 do_syscall_64+0x6d/0x110
Augment struct intel_pmt_entry with a pointer to the pcidev to avoid the NULL pointer exception.
Weakness: CWE-476
Which versions are affected by CVE-2025-38559?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38559?
Apply the vendor's patch.
Is CVE-2025-38559 being exploited?
There is no known exploitation of CVE-2025-38559 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38559, DEBIAN-CVE-2025-38559, GHSA-g3wv-hmmw-34hr, ROOT-OS-DEBIAN-13-CVE-2025-38559, UBUNTU-CVE-2025-38559.