CVE-2025-38559

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/intel/pmt: fix a crashlog NULL pointer access

Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry endpoint usage.

Without the ep, the crashlog usage causes the following NULL pointer exception:

BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:intel_pmt_read+0x3b/0x70 [pmt_class] Code: Call Trace: <TASK> ? sysfs_kf_bin_read+0xc0/0xe0 kernfs_fop_read_iter+0xac/0x1a0 vfs_read+0x26d/0x350 ksys_read+0x6b/0xe0 __x64_sys_read+0x1d/0x30 x64_sys_call+0x1bc8/0x1d70 do_syscall_64+0x6d/0x110

Augment struct intel_pmt_entry with a pointer to the pcidev to avoid the NULL pointer exception.

This bug in the Intel PMT driver could cause a NULL pointer dereference when accessing crashlog entries through sysfs. The issue occurred because the intel_pmt_read() function assumed a valid pcidev pointer was always available, but in the crashlog case it was not initialized. As a result, reading the sysfs binary attribute could trigger a kernel crash, but it does not provide a way to escalate privileges or compromise data

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.