CVE-2025-38581
📋 TL;DR
A NULL pointer dereference vulnerability in the Linux kernel's AMD Cryptographic Coprocessor (CCP) driver causes a kernel crash when rebinding the CCP device with debugfs enabled. This affects Linux systems with AMD cryptographic hardware and the CONFIG_CRYPTO_DEV_CCP_DEBUGFS kernel configuration option enabled. The vulnerability can lead to denial of service through kernel panic.
💻 Affected Systems
- Linux kernel with AMD Cryptographic Coprocessor (CCP) driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.
Likely Case
Local denial of service when rebinding CCP device, requiring system reboot to recover.
If Mitigated
No impact if debugfs is disabled or CCP hardware is not present.
🎯 Exploit Status
Requires local access and ability to execute device rebinding commands (typically root or privileged user).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits 181698af38d3f93381229ad89c09b5bd0496661a or related fixes
Vendor Advisory: https://git.kernel.org/stable/c/181698af38d3f93381229ad89c09b5bd0496661a
Restart Required: No
Instructions:
1. Update Linux kernel to patched version. 2. Rebuild kernel if using custom configuration. 3. No reboot required for hotfix via module reload.
🔧 Temporary Workarounds
Disable CCP debugfs
allDisable CONFIG_CRYPTO_DEV_CCP_DEBUGFS kernel configuration option
Rebuild kernel with CONFIG_CRYPTO_DEV_CCP_DEBUGFS=n
Avoid CCP device rebinding
LinuxRestrict access to device rebinding operations
chmod 600 /sys/bus/pci/drivers/ccp/bind
chmod 600 /sys/bus/pci/drivers/ccp/unbind
🧯 If You Can't Patch
- Restrict access to /sys/bus/pci/drivers/ccp/ directory to root only
- Monitor for crash logs and restrict user privileges that can trigger device rebinding
🔍 How to Verify
Check if Vulnerable:
Check if CONFIG_CRYPTO_DEV_CCP_DEBUGFS is enabled: grep CONFIG_CRYPTO_DEV_CCP_DEBUGFS /boot/config-$(uname -r)Check Version:
uname -rVerify Fix Applied:
Check kernel version includes fix commits: uname -r and verify against patched versions📡 Detection & Monitoring
Log Indicators:
- Kernel NULL pointer dereference messages
- Oops: 0002 errors in dmesg
- CCP driver crash logs
Network Indicators:
- None - local vulnerability only
SIEM Query:
search 'NULL pointer dereference' AND 'ccp' in kernel logs🔗 References
- https://git.kernel.org/stable/c/181698af38d3f93381229ad89c09b5bd0496661a
- https://git.kernel.org/stable/c/20c0ed8dd65834e6bab464f54cd6ff68659bacb9
- https://git.kernel.org/stable/c/2d4060f05e74dbee884ba723f6afd9282befc3c5
- https://git.kernel.org/stable/c/64ec9a7e7a6398b172ab6feba60e952163a1c3d5
- https://git.kernel.org/stable/c/6eadf50c1d894cb34f3237064063207460946040
- https://git.kernel.org/stable/c/9dea08eac4f6d6fbbae59992978252e2edab995d
- https://git.kernel.org/stable/c/a25ab6dfa0ce323ec308966988be6b675eb9d3e5
- https://git.kernel.org/stable/c/ce63a83925964ab7564bd216bd92b80bc365492e
- https://git.kernel.org/stable/c/db111468531777cac8b4beb6515a88a54b0c4a74
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
