CVE-2025-38275

phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug

State: Published
Severity: Not scored
Published: Jul 10, 2025
Updated: May 23, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug

The qmp_usb_iomap() helper function currently returns the raw result of devm_ioremap() for non-exclusive mappings. Since devm_ioremap() may return a NULL pointer and the caller only checks error pointers with IS_ERR(), NULL could bypass the check and lead to an invalid dereference.

Fix the issue by checking if devm_ioremap() returns NULL. When it does, qmp_usb_iomap() now returns an error pointer via IOMEM_ERR_PTR(-ENOMEM), ensuring safe and consistent error handling.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before 0b979a409e40457ca1b5cb48755d1f34eee58805Affected a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before 127dfb4f1c5a2b622039c5d203f321380ea36665Affected a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before 5072c1749197fc28b27d7efc0d80320d7cac9572Affected a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before 0c33117f00c8c5363c22676931b22ae5041f7603Affected a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before d14402a38c2d868cacb1facaf9be908ca6558e59Affected 368ea32e0ad0335bdf3180067875a928e35387c6Affected 5.15.93 to before 5.16Affected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.142 through 6.1.Not affected 6.6.94 through 6.6.Not affected 6.12.34 through 6.12.Not affected 6.15.3 through 6.15.Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before 0b979a409e40457ca1b5cb48755d1f34eee58805Affected
a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before 127dfb4f1c5a2b622039c5d203f321380ea36665Affected
a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before 5072c1749197fc28b27d7efc0d80320d7cac9572Affected
a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before 0c33117f00c8c5363c22676931b22ae5041f7603Affected
a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd to before d14402a38c2d868cacb1facaf9be908ca6558e59Affected
368ea32e0ad0335bdf3180067875a928e35387c6Affected
5.15.93 to before 5.16Affected

LinuxLinux

6.1Affected
before 6.1Not affected
6.1.142 through 6.1.*Not affected
6.6.94 through 6.6.*Not affected
6.12.34 through 6.12.*Not affected
6.15.3 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.