{"id":"CVE-2025-38134","title":"usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()\n\nAs demonstrated by the fix for update_port_device_state,\ncommit 12783c0b9e2c (\"usb: core: Pr…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= f1bfb4a6fed64de1771b43a76631942279851744 < 8fa544bff8466062e42949c93f3e528f4be5624b","Linux >= f1bfb4a6fed64de1771b43a76631942279851744 < e3d530173b70514d4390a94f9f979acad689b70a","Linux >= f1bfb4a6fed64de1771b43a76631942279851744 < 73fb0ec9436ae87bcae067ce35d6cdd72bade86c","Linux 6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:50:19.394673Z"},"published":"2025-07-03","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:52:17.166Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38134","references":[{"url":"https://git.kernel.org/stable/c/8fa544bff8466062e42949c93f3e528f4be5624b"},{"url":"https://git.kernel.org/stable/c/e3d530173b70514d4390a94f9f979acad689b70a"},{"url":"https://git.kernel.org/stable/c/73fb0ec9436ae87bcae067ce35d6cdd72bade86c"}],"tags":["cve.org"],"epss":0.00191,"epssPercentile":0.08806,"ingestedAt":"2026-11-05T22:38:31.923Z","slug":"CVE-2025-38134","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()\n\nAs demonstrated by the fix for update_port_device_state,\ncommit 12783c0b9e2c (\"usb: core: Prevent null pointer dereference in update_port_device_state\"),\nusb_hub_to_struct_hub() can return NULL in certain scenarios,\nsuch as during hub driver unbind or teardown race conditions,\neven if the underlying usb_device structure exists.\n\nPlus, all other places that call usb_hub_to_struct_hub() in the same file\ndo check for NULL return values.\n\nIf usb_hub_to_struct_hub() returns NULL, the subsequent access to\nhub->ports[udev->portnum - 1] will cause a null pointer dereference.\n\n## Affected\n\n- `Linux >= f1bfb4a6fed64de1771b43a76631942279851744 < 8fa544bff8466062e42949c93f3e528f4be5624b`\n- `Linux >= f1bfb4a6fed64de1771b43a76631942279851744 < e3d530173b70514d4390a94f9f979acad689b70a`\n- `Linux >= f1bfb4a6fed64de1771b43a76631942279851744 < 73fb0ec9436ae87bcae067ce35d6cdd72bade86c`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}