---
id: CVE-2025-38629
title: 'ALSA: usb: scarlett2: Fix missing NULL check'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: usb: scarlett2: Fix missing NULL check

  scarlett2_input_select_ctl_info() sets up the string arrays allocated
  via kasprintf(), but it misses NULL checks, which ma…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8eba063b5b2b498ddd01ea6f29fc9b12368c3d53 <
    d558db85920b124bac36f8a7ddc5de0aa7491bdd
  - >-
    Linux >= 8eba063b5b2b498ddd01ea6f29fc9b12368c3d53 <
    2c735fcaee81ad8056960659dc9dc460891e76b0
  - >-
    Linux >= 8eba063b5b2b498ddd01ea6f29fc9b12368c3d53 <
    df485a4b2b3ee5b35c80f990beb554e38a8a5fb1
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:05:25.500852Z'
published: '2025-08-22'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:49.641Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38629'
references:
  - url: 'https://git.kernel.org/stable/c/d558db85920b124bac36f8a7ddc5de0aa7491bdd'
  - url: 'https://git.kernel.org/stable/c/2c735fcaee81ad8056960659dc9dc460891e76b0'
  - url: 'https://git.kernel.org/stable/c/df485a4b2b3ee5b35c80f990beb554e38a8a5fb1'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.05746
ingestedAt: '2026-11-05T22:38:32.002Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb: scarlett2: Fix missing NULL check

scarlett2_input_select_ctl_info() sets up the string arrays allocated
via kasprintf(), but it misses NULL checks, which may lead to NULL
dereference Oops.  Let's add the proper NULL check.

## Affected

- `Linux >= 8eba063b5b2b498ddd01ea6f29fc9b12368c3d53 < d558db85920b124bac36f8a7ddc5de0aa7491bdd`
- `Linux >= 8eba063b5b2b498ddd01ea6f29fc9b12368c3d53 < 2c735fcaee81ad8056960659dc9dc460891e76b0`
- `Linux >= 8eba063b5b2b498ddd01ea6f29fc9b12368c3d53 < df485a4b2b3ee5b35c80f990beb554e38a8a5fb1`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.