# CVE-2025-38265: serial: jsm: fix NPE during jsm_uart_port_init

Status: published. Published: 2025-07-10. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

serial: jsm: fix NPE during jsm_uart_port_init

No device was set which caused serial_base_ctrl_add to crash.

 BUG: kernel NULL pointer dereference, address: 0000000000000050
 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
 CPU: 16 UID: 0 PID: 368 Comm: (udev-worker) Not tainted 6.12.25-amd64 #1  Debian 6.12.25-1
 RIP: 0010:serial_base_ctrl_add+0x96/0x120
 Call Trace:
  <TASK>
  serial_core_register_port+0x1a0/0x580
  ? __setup_irq+0x39c/0x660
  ? __kmalloc_cache_noprof+0x111/0x310
  jsm_uart_port_init+0xe8/0x180 [jsm]
  jsm_probe_one+0x1f4/0x410 [jsm]
  local_pci_probe+0x42/0x90
  pci_device_probe+0x22f/0x270
  really_probe+0xdb/0x340
  ? pm_runtime_barrier+0x54/0x90
  ? __pfx___driver_attach+0x10/0x10
  __driver_probe_device+0x78/0x110
  driver_probe_device+0x1f/0xa0
  __driver_attach+0xba/0x1c0
  bus_for_each_dev+0x8c/0xe0
  bus_add_driver+0x112/0x1f0
  driver_register+0x72/0xd0
  jsm_init_module+0x36/0xff0 [jsm]
  ? __pfx_jsm_init_module+0x10/0x10 [jsm]
  do_one_initcall+0x58/0x310
  do_init_module+0x60/0x230

Tested with Digi Neo PCIe 8 port card.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 84a9582fd203063cd4d301204971ff2cd8327f1a; < 3258d7ff8ebfa451426662b23e8f2b51b129afe1 (affected, git); ≥ 84a9582fd203063cd4d301204971ff2cd8327f1a; < 985961dd2688a527a4847300d41beaad475ab7af (affected, git); ≥ 84a9582fd203063cd4d301204971ff2cd8327f1a; < a14c0d2eb3f0b1836fdec22908b87ecffd2ac844 (affected, git); ≥ 84a9582fd203063cd4d301204971ff2cd8327f1a; < abaecb2a4ad021c2f2426e9b2a9c020aef57aca9 (affected, git); ≥ 84a9582fd203063cd4d301204971ff2cd8327f1a; < e3975aa899c0a3bbc10d035e699b142cd1373a71 (affected, git). Source: CNA: Linux
- Linux / Linux: 6.5 (affected); ≥ 0; < 6.5 (unaffected, semver); ≥ 6.6.94; ≤ 6.6.* (unaffected, semver); ≥ 6.12.33; ≤ 6.12.* (unaffected, semver); ≥ 6.14.11; ≤ 6.14.* (unaffected, semver); ≥ 6.15.2; ≤ 6.15.* (unaffected, semver); ≥ 6.16; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.19% as of 2026-11-05; percentile 8.58%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/3258d7ff8ebfa451426662b23e8f2b51b129afe1 (CNA: Linux)

- https://git.kernel.org/stable/c/985961dd2688a527a4847300d41beaad475ab7af (CNA: Linux)

- https://git.kernel.org/stable/c/a14c0d2eb3f0b1836fdec22908b87ecffd2ac844 (CNA: Linux)

- https://git.kernel.org/stable/c/abaecb2a4ad021c2f2426e9b2a9c020aef57aca9 (CNA: Linux)

- https://git.kernel.org/stable/c/e3975aa899c0a3bbc10d035e699b142cd1373a71 (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2025-38265; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-38265; retrieved 2026-11-05; source updated Not reported

Revision: 05194b886da3a8845da4fa30e300d6e3864f4c6a98dd729ac21ff0cf50c84215

Canonical: https://y2.dev/cve/CVE-2025-38265

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.