CVE-2025-38536
16.08.2025, 12:15
In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix potential use-after-free in airoha_npu_get() np->name was being used after calling of_node_put(np), which releases the node and can lead to a use-after-free bug. Previously, of_node_put(np) was called unconditionally after of_find_device_by_node(np), which could result in a use-after-free if pdev is NULL. This patch moves of_node_put(np) after the error check to ensure the node is only released after both the error and success cases are handled appropriately, preventing potential resource issues.Enginsight
| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 6.15 ≤ 𝑥 < 6.15.8 |
| linux | linux_kernel | 6.16:rc1 |
| linux | linux_kernel | 6.16:rc2 |
| linux | linux_kernel | 6.16:rc3 |
| linux | linux_kernel | 6.16:rc4 |
| linux | linux_kernel | 6.16:rc5 |
| linux | linux_kernel | 6.16:rc6 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration