CVE-2025-38629

low-risk
Published 2025-08-22

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: scarlett2: Fix missing NULL check scarlett2_input_select_ctl_info() sets up the string arrays allocated via kasprintf(), but it misses NULL checks, which may lead to NULL dereference Oops. Let's add the proper NULL check.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Linux

References (3)

Patch https://git.kernel.org/stable/c/2c735fcaee81ad8056960659dc9dc460891e76b0
Patch https://git.kernel.org/stable/c/d558db85920b124bac36f8a7ddc5de0aa7491bdd
Patch https://git.kernel.org/stable/c/df485a4b2b3ee5b35c80f990beb554e38a8a5fb1
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal