CVE-2025-38210

configfs-tsm-report: Fix NULL dereference of tsm_ops

published July 4, 2025

CVSS
—
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

configfs-tsm-report: Fix NULL dereference of tsm_ops

Unlike sysfs, the lifetime of configfs objects is controlled by

userspace. There is no mechanism for the kernel to find and delete all

created config-items. Instead, the configfs-tsm-report mechanism has an

expectation that tsm_unregister() can happen at any time and cause

established config-item access to start failing.

That expectation is not fully satisfied. While tsm_report_read(),

tsm_report_{is,is_bin}_visible(), and tsm_report_make_item() safely fail

if tsm_ops have been unregistered, tsm_report_privlevel_store()

tsm_report_provider_show() fail to check for ops registration. Add the

missing checks for tsm_ops having been removed.

Now, in supporting the ability for tsm_unregister() to always succeed,

it leaves the problem of what to do with lingering config-items. The

expectation is that the admin that arranges for the ->remove() (unbind)

of the ${tsm_arch}-guest driver is also responsible for deletion of all

open config-items. Until that deletion happens, ->probe() (reload /

bind) of the ${tsm_arch}-guest driver fails.

This allows for emergency shutdown / revocation of attestation

interfaces, and requires coordinated restart.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.7th percentile
Published
2025-07-04T13:37Z
EPSS history
Timeline
  • 04 JUL 13:37Z
    configfs-tsm-report: Fix NULL dereference of tsm_ops
    cvelistv5