---
id: CVE-2025-38134
title: 'usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()

  As demonstrated by the fix for update_port_device_state,
  commit 12783c0b9e2c ("usb: core: Pr…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f1bfb4a6fed64de1771b43a76631942279851744 <
    8fa544bff8466062e42949c93f3e528f4be5624b
  - >-
    Linux >= f1bfb4a6fed64de1771b43a76631942279851744 <
    e3d530173b70514d4390a94f9f979acad689b70a
  - >-
    Linux >= f1bfb4a6fed64de1771b43a76631942279851744 <
    73fb0ec9436ae87bcae067ce35d6cdd72bade86c
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:50:19.394673Z'
published: '2025-07-03'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:52:17.166Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38134'
references:
  - url: 'https://git.kernel.org/stable/c/8fa544bff8466062e42949c93f3e528f4be5624b'
  - url: 'https://git.kernel.org/stable/c/e3d530173b70514d4390a94f9f979acad689b70a'
  - url: 'https://git.kernel.org/stable/c/73fb0ec9436ae87bcae067ce35d6cdd72bade86c'
tags:
  - cve.org
epss: 0.00191
epssPercentile: 0.08806
ingestedAt: '2026-11-05T22:38:31.923Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()

As demonstrated by the fix for update_port_device_state,
commit 12783c0b9e2c ("usb: core: Prevent null pointer dereference in update_port_device_state"),
usb_hub_to_struct_hub() can return NULL in certain scenarios,
such as during hub driver unbind or teardown race conditions,
even if the underlying usb_device structure exists.

Plus, all other places that call usb_hub_to_struct_hub() in the same file
do check for NULL return values.

If usb_hub_to_struct_hub() returns NULL, the subsequent access to
hub->ports[udev->portnum - 1] will cause a null pointer dereference.

## Affected

- `Linux >= f1bfb4a6fed64de1771b43a76631942279851744 < 8fa544bff8466062e42949c93f3e528f4be5624b`
- `Linux >= f1bfb4a6fed64de1771b43a76631942279851744 < e3d530173b70514d4390a94f9f979acad689b70a`
- `Linux >= f1bfb4a6fed64de1771b43a76631942279851744 < 73fb0ec9436ae87bcae067ce35d6cdd72bade86c`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.