{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"015f04ac884a454d4d8aaa7b67758f047742b1cf","status":"affected","version":"70e6f7e2b98575621019aa40ac616be58ff984e0","versionType":"git"},{"lessThan":"cefbafcbdef011d6ef9414902311afdfba3c33eb","status":"affected","version":"70e6f7e2b98575621019aa40ac616be58ff984e0","versionType":"git"},{"lessThan":"fba4ceaa242d2bdf4c04b77bda41d32d02d3925d","status":"affected","version":"70e6f7e2b98575621019aa40ac616be58ff984e0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.35","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2025-38210","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs-tsm-report: Fix NULL dereference of tsm_ops\n\nUnlike sysfs, the lifetime of configfs objects is controlled by\nuserspace. There is no mechanism for the kernel to find and delete all\ncreated config-items. Instead, the configfs-tsm-report mechanism has an\nexpectation that tsm_unregister() can happen at any time and cause\nestablished config-item access to start failing.\n\nThat expectation is not fully satisfied. While tsm_report_read(),\ntsm_report_{is,is_bin}_visible(), and tsm_report_make_item() safely fail\nif tsm_ops have been unregistered, tsm_report_privlevel_store()\ntsm_report_provider_show() fail to check for ops registration. Add the\nmissing checks for tsm_ops having been removed.\n\nNow, in supporting the ability for tsm_unregister() to always succeed,\nit leaves the problem of what to do with lingering config-items. The\nexpectation is that the admin that arranges for the ->remove() (unbind)\nof the ${tsm_arch}-guest driver is also responsible for deletion of all\nopen config-items. Until that deletion happens, ->probe() (reload /\nbind) of the ${tsm_arch}-guest driver fails.\n\nThis allows for emergency shutdown / revocation of attestation\ninterfaces, and requires coordinated restart.","epss":{"date":"2026-11-05","percentile":0.07124,"score":0.00176},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793911940855,"publishedAt":1751636249663,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/015f04ac884a454d4d8aaa7b67758f047742b1cf"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/cefbafcbdef011d6ef9414902311afdfba3c33eb"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/fba4ceaa242d2bdf4c04b77bda41d32d02d3925d"}],"remediation":[],"revision":"49badef7b687e7ac87d00a80cb75d074a6f2a9f66a6d13ef557e6bf0dd4e71a1","sources":[{"modifiedAt":1793911940855,"name":"CNA: Linux","retrievedAt":1793913616195,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38210"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913635816,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38210"}],"ssvc":{"assessedAt":1793911891334,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"configfs-tsm-report: Fix NULL dereference of tsm_ops","updatedAt":1793913635816}