In the Linux kernel, the following vulnerability has been resolved:
phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
The qmpusbiomap() helper function currently returns the raw result of devmioremap() for non-exclusive mappings. Since devmioremap() may return a NULL pointer and the caller only checks error pointers with IS_ERR(), NULL could bypass the check and lead to an invalid dereference.
Fix the issue by checking if devmioremap() returns NULL. When it does, qmpusbiomap() now returns an error pointer via IOMEMERR_PTR(-ENOMEM), ensuring safe and consistent error handling.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "273439524425078515746950768118475700818",
"length": 307.0
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c",
"function": "qmp_usb_iomap"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@127dfb4f1c5a2b622039c5d203f321380ea36665",
"id": "CVE-2025-38275-7d214476",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114341654329218178764623536255123038579",
"75179566370563357152517088134634448136",
"60991206830595436569758453278015857280",
"287524292927066880947297303071445664199",
"229710937189494156431694055789023514565",
"137828754586202959337460802892909803673",
"116741410990814500108344133368387925152",
"169142050247763229424923246747793096078"
]
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5072c1749197fc28b27d7efc0d80320d7cac9572",
"id": "CVE-2025-38275-9841f0f2",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114341654329218178764623536255123038579",
"75179566370563357152517088134634448136",
"60991206830595436569758453278015857280",
"287524292927066880947297303071445664199",
"229710937189494156431694055789023514565",
"137828754586202959337460802892909803673",
"116741410990814500108344133368387925152",
"169142050247763229424923246747793096078"
]
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d14402a38c2d868cacb1facaf9be908ca6558e59",
"id": "CVE-2025-38275-9c817246",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114341654329218178764623536255123038579",
"75179566370563357152517088134634448136",
"60991206830595436569758453278015857280",
"287524292927066880947297303071445664199",
"229710937189494156431694055789023514565",
"137828754586202959337460802892909803673",
"116741410990814500108344133368387925152",
"169142050247763229424923246747793096078"
]
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b979a409e40457ca1b5cb48755d1f34eee58805",
"id": "CVE-2025-38275-c261d28d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114341654329218178764623536255123038579",
"75179566370563357152517088134634448136",
"60991206830595436569758453278015857280",
"287524292927066880947297303071445664199",
"229710937189494156431694055789023514565",
"137828754586202959337460802892909803673",
"116741410990814500108344133368387925152",
"169142050247763229424923246747793096078"
]
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@127dfb4f1c5a2b622039c5d203f321380ea36665",
"id": "CVE-2025-38275-d93349d3",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "273439524425078515746950768118475700818",
"length": 307.0
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c",
"function": "qmp_usb_iomap"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c33117f00c8c5363c22676931b22ae5041f7603",
"id": "CVE-2025-38275-dcebb54f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "273439524425078515746950768118475700818",
"length": 307.0
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c",
"function": "qmp_usb_iomap"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b979a409e40457ca1b5cb48755d1f34eee58805",
"id": "CVE-2025-38275-f1adcf73",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "273439524425078515746950768118475700818",
"length": 307.0
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c",
"function": "qmp_usb_iomap"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5072c1749197fc28b27d7efc0d80320d7cac9572",
"id": "CVE-2025-38275-f579b899",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "273439524425078515746950768118475700818",
"length": 307.0
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c",
"function": "qmp_usb_iomap"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d14402a38c2d868cacb1facaf9be908ca6558e59",
"id": "CVE-2025-38275-f78a13c8",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114341654329218178764623536255123038579",
"75179566370563357152517088134634448136",
"60991206830595436569758453278015857280",
"287524292927066880947297303071445664199",
"229710937189494156431694055789023514565",
"137828754586202959337460802892909803673",
"116741410990814500108344133368387925152",
"169142050247763229424923246747793096078"
]
},
"target": {
"file": "drivers/phy/qualcomm/phy-qcom-qmp-usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c33117f00c8c5363c22676931b22ae5041f7603",
"id": "CVE-2025-38275-fed565dc",
"deprecated": false,
"signature_version": "v1"
}
]