CVE-2025-38664

ice: Fix a null pointer dereference in ice_copy_and_init_pkg()

MEDIUM

5.5

CVSS Score

Published: August 22, 2025 at 04:02 PM UTC

Updated: June 17, 2026 at 09:17 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

5.11 ≤ v < 5.15.1905.16 ≤ v < 6.1.1485.4 ≤ v < 5.10.2415.4 ≤ v < 5.15.1905.4 ≤ v < 5.4.2975.4 ≤ v < 6.1.1485.4 ≤ v < 6.12.415.4 ≤ v < 6.15.95.4 ≤ v < 6.165.4 ≤ v < 6.6.1015.5 ≤ v < 5.10.2416.13 ≤ v < 6.15.96.2 ≤ v < 6.6.1016.7 ≤ v < 6.12.415.4 6.16 rc1 6.16 rc2 6.16 rc3 6.16 rc4 6.16 rc5 6.16 rc6 6.16 rc7c7648810961682b9388be2dd041df06915647445

Vendor states this is fixed in 0fde7dccbf4c8a6d7940ecaf4c3d80a12f405dd7 (fixed)

Vendor states this is fixed in 1c30093d58cd3d02d8358e2b1f4a06a0aae0bf5b (fixed)

Vendor states this is fixed in 3028f2a4e746b499043bbb8ab816f975473a0535 (fixed)

Vendor states this is fixed in 35370d3b44efe194fd5ad55bac987e629597d782 (fixed)

Vendor states this is fixed in 435462f8ab2b9c5340a5414ce02f70117d0cfede (fixed)

Vendor states this is fixed in 4ff12d82dac119b4b99b5a78b5af3bf2474c0a36 (fixed)

Vendor states this is fixed in 6d640a8ea62435a7f6f89869bee4fa99423d07ca (fixed)

Vendor states this is fixed in 7c5a13c76dd37e9e4f8d48b87376a54f4399ce15 (fixed)

Vendor states this is fixed in 5.10.241 (unaffected)

Vendor states this is fixed in 5.15.190 (unaffected)

Vendor states this is fixed in 5.4 (unaffected)

Vendor states this is fixed in 5.4.297 (unaffected)