---
id: CVE-2025-38210
title: 'configfs-tsm-report: Fix NULL dereference of tsm_ops'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  configfs-tsm-report: Fix NULL dereference of tsm_ops

  Unlike sysfs, the lifetime of configfs objects is controlled by
  userspace. There is no mechanism for the kernel to…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 <
    015f04ac884a454d4d8aaa7b67758f047742b1cf
  - >-
    Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 <
    cefbafcbdef011d6ef9414902311afdfba3c33eb
  - >-
    Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 <
    fba4ceaa242d2bdf4c04b77bda41d32d02d3925d
  - Linux 6.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:51:31.334550Z'
published: '2025-07-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:52:20.855Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38210'
references:
  - url: 'https://git.kernel.org/stable/c/015f04ac884a454d4d8aaa7b67758f047742b1cf'
  - url: 'https://git.kernel.org/stable/c/cefbafcbdef011d6ef9414902311afdfba3c33eb'
  - url: 'https://git.kernel.org/stable/c/fba4ceaa242d2bdf4c04b77bda41d32d02d3925d'
tags:
  - cve.org
epss: 0.0018
epssPercentile: 0.0762
ingestedAt: '2026-11-05T22:38:31.931Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

configfs-tsm-report: Fix NULL dereference of tsm_ops

Unlike sysfs, the lifetime of configfs objects is controlled by
userspace. There is no mechanism for the kernel to find and delete all
created config-items. Instead, the configfs-tsm-report mechanism has an
expectation that tsm_unregister() can happen at any time and cause
established config-item access to start failing.

That expectation is not fully satisfied. While tsm_report_read(),
tsm_report_{is,is_bin}_visible(), and tsm_report_make_item() safely fail
if tsm_ops have been unregistered, tsm_report_privlevel_store()
tsm_report_provider_show() fail to check for ops registration. Add the
missing checks for tsm_ops having been removed.

Now, in supporting the ability for tsm_unregister() to always succeed,
it leaves the problem of what to do with lingering config-items. The
expectation is that the admin that arranges for the ->remove() (unbind)
of the ${tsm_arch}-guest driver is also responsible for deletion of all
open config-items. Until that deletion happens, ->probe() (reload /
bind) of the ${tsm_arch}-guest driver fails.

This allows for emergency shutdown / revocation of attestation
interfaces, and requires coordinated restart.

## Affected

- `Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 < 015f04ac884a454d4d8aaa7b67758f047742b1cf`
- `Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 < cefbafcbdef011d6ef9414902311afdfba3c33eb`
- `Linux >= 70e6f7e2b98575621019aa40ac616be58ff984e0 < fba4ceaa242d2bdf4c04b77bda41d32d02d3925d`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.