In the Linux kernel, the following vulnerability has been resolved:
phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
The qmpusbiomap() helper function currently returns the raw result of devmioremap() for non-exclusive mappings. Since devmioremap() may return a NULL pointer and the caller only checks error pointers with IS_ERR(), NULL could bypass the check and lead to an invalid dereference.
Fix the issue by checking if devmioremap() returns NULL. When it does, qmpusbiomap() now returns an error pointer via IOMEMERR_PTR(-ENOMEM), ensuring safe and consistent error handling.
[ { "signature_type": "Function", "id": "CVE-2025-38275-7d214476", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@127dfb4f1c5a2b622039c5d203f321380ea36665", "signature_version": "v1", "target": { "function": "qmp_usb_iomap", "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "function_hash": "273439524425078515746950768118475700818", "length": 307.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38275-9841f0f2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5072c1749197fc28b27d7efc0d80320d7cac9572", "signature_version": "v1", "target": { "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "114341654329218178764623536255123038579", "75179566370563357152517088134634448136", "60991206830595436569758453278015857280", "287524292927066880947297303071445664199", "229710937189494156431694055789023514565", "137828754586202959337460802892909803673", "116741410990814500108344133368387925152", "169142050247763229424923246747793096078" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38275-9c817246", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d14402a38c2d868cacb1facaf9be908ca6558e59", "signature_version": "v1", "target": { "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "114341654329218178764623536255123038579", "75179566370563357152517088134634448136", "60991206830595436569758453278015857280", "287524292927066880947297303071445664199", "229710937189494156431694055789023514565", "137828754586202959337460802892909803673", "116741410990814500108344133368387925152", "169142050247763229424923246747793096078" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38275-c261d28d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b979a409e40457ca1b5cb48755d1f34eee58805", "signature_version": "v1", "target": { "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "114341654329218178764623536255123038579", "75179566370563357152517088134634448136", "60991206830595436569758453278015857280", "287524292927066880947297303071445664199", "229710937189494156431694055789023514565", "137828754586202959337460802892909803673", "116741410990814500108344133368387925152", "169142050247763229424923246747793096078" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38275-d93349d3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@127dfb4f1c5a2b622039c5d203f321380ea36665", "signature_version": "v1", "target": { "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "114341654329218178764623536255123038579", "75179566370563357152517088134634448136", "60991206830595436569758453278015857280", "287524292927066880947297303071445664199", "229710937189494156431694055789023514565", "137828754586202959337460802892909803673", "116741410990814500108344133368387925152", "169142050247763229424923246747793096078" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38275-dcebb54f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c33117f00c8c5363c22676931b22ae5041f7603", "signature_version": "v1", "target": { "function": "qmp_usb_iomap", "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "function_hash": "273439524425078515746950768118475700818", "length": 307.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38275-f1adcf73", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b979a409e40457ca1b5cb48755d1f34eee58805", "signature_version": "v1", "target": { "function": "qmp_usb_iomap", "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "function_hash": "273439524425078515746950768118475700818", "length": 307.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38275-f579b899", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5072c1749197fc28b27d7efc0d80320d7cac9572", "signature_version": "v1", "target": { "function": "qmp_usb_iomap", "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "function_hash": "273439524425078515746950768118475700818", "length": 307.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38275-f78a13c8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d14402a38c2d868cacb1facaf9be908ca6558e59", "signature_version": "v1", "target": { "function": "qmp_usb_iomap", "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "function_hash": "273439524425078515746950768118475700818", "length": 307.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38275-fed565dc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c33117f00c8c5363c22676931b22ae5041f7603", "signature_version": "v1", "target": { "file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "114341654329218178764623536255123038579", "75179566370563357152517088134634448136", "60991206830595436569758453278015857280", "287524292927066880947297303071445664199", "229710937189494156431694055789023514565", "137828754586202959337460802892909803673", "116741410990814500108344133368387925152", "169142050247763229424923246747793096078" ] }, "deprecated": false } ]