CVE-2025-38664

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix a null pointer dereference in ice_copy_and_init_pkg()

Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference.

A missing NULL check after devm_kmemdup() in the Intel ICE driver could lead to a kernel NULL pointer dereference during DDP package initialization, causing a denial of service. Triggering typically requires administrative privileges to load/update the DDP package and conditions leading to allocation failure. No confidentiality or integrity impact is expected; availability is high. Exploitation requires administrative privileges because only privileged users can load or update Intel ICE Dynamic Device Personalization (DDP) packages or otherwise trigger the affected initialization path, making the required privilege level High.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.