{"id":"CVE-2025-38210","title":"configfs-tsm-report: Fix NULL dereference of tsm_ops","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs-tsm-report: Fix NULL dereference of tsm_ops\n\nUnlike sysfs, the lifetime of configfs objects is controlled by\nuserspace. There is no mechanism for the kernel to…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 < 015f04ac884a454d4d8aaa7b67758f047742b1cf","Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 < cefbafcbdef011d6ef9414902311afdfba3c33eb","Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 < fba4ceaa242d2bdf4c04b77bda41d32d02d3925d","Linux 6.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:51:31.334550Z"},"published":"2025-07-04","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:52:20.855Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38210","references":[{"url":"https://git.kernel.org/stable/c/015f04ac884a454d4d8aaa7b67758f047742b1cf"},{"url":"https://git.kernel.org/stable/c/cefbafcbdef011d6ef9414902311afdfba3c33eb"},{"url":"https://git.kernel.org/stable/c/fba4ceaa242d2bdf4c04b77bda41d32d02d3925d"}],"tags":["cve.org"],"epss":0.0018,"epssPercentile":0.0762,"ingestedAt":"2026-11-05T22:38:31.931Z","slug":"CVE-2025-38210","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs-tsm-report: Fix NULL dereference of tsm_ops\n\nUnlike sysfs, the lifetime of configfs objects is controlled by\nuserspace. There is no mechanism for the kernel to find and delete all\ncreated config-items. Instead, the configfs-tsm-report mechanism has an\nexpectation that tsm_unregister() can happen at any time and cause\nestablished config-item access to start failing.\n\nThat expectation is not fully satisfied. While tsm_report_read(),\ntsm_report_{is,is_bin}_visible(), and tsm_report_make_item() safely fail\nif tsm_ops have been unregistered, tsm_report_privlevel_store()\ntsm_report_provider_show() fail to check for ops registration. Add the\nmissing checks for tsm_ops having been removed.\n\nNow, in supporting the ability for tsm_unregister() to always succeed,\nit leaves the problem of what to do with lingering config-items. The\nexpectation is that the admin that arranges for the ->remove() (unbind)\nof the ${tsm_arch}-guest driver is also responsible for deletion of all\nopen config-items. Until that deletion happens, ->probe() (reload /\nbind) of the ${tsm_arch}-guest driver fails.\n\nThis allows for emergency shutdown / revocation of attestation\ninterfaces, and requires coordinated restart.\n\n## Affected\n\n- `Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 < 015f04ac884a454d4d8aaa7b67758f047742b1cf`\n- `Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 < cefbafcbdef011d6ef9414902311afdfba3c33eb`\n- `Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 < fba4ceaa242d2bdf4c04b77bda41d32d02d3925d`\n- `Linux 6.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}