CVE-2025-38275

phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug

published July 10, 2025

CVSS
—
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug

The qmp_usb_iomap() helper function currently returns the raw result of

devm_ioremap() for non-exclusive mappings. Since devm_ioremap() may return

a NULL pointer and the caller only checks error pointers with IS_ERR(),

NULL could bypass the check and lead to an invalid dereference.

Fix the issue by checking if devm_ioremap() returns NULL. When it does,

qmp_usb_iomap() now returns an error pointer via IOMEM_ERR_PTR(-ENOMEM),

ensuring safe and consistent error handling.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.3th percentile
Published
2025-07-10T07:41Z
EPSS history
Timeline
  • 10 JUL 07:41Z
    phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
    cvelistv5