CVE-2025-38152

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

remoteproc: core: Clear table_sz when rproc_shutdown

There is case as below could trigger kernel dump:

Use U-Boot to start remote processor(rproc) with resource table

published to a fixed address by rproc. After Kernel boots up,

stop the rproc, load a new firmware which doesn't have resource table

,and start rproc.

When starting rproc with a firmware not have resource table,

`memcpy(loaded_table, rproc->cached_table, rproc->table_sz)` will

trigger dump, because rproc->cache_table is set to NULL during the last

stop operation, but rproc->table_sz is still valid.

This issue is found on i.MX8MP and i.MX9.

Dump as below:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

Mem abort info:

ESR = 0x0000000096000004

EC = 0x25: DABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

FSC = 0x04: level 0 translation fault

Data abort info:

ISV = 0, ISS = 0x00000004, ISS2

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References