Not yet scoredPublished Dec 16, 2025

CVE-2025-68238mtd: rawnand: cadence: fix DMA device NULL pointer dereference

Updated under an hour ago (Oct 27, 2026, 10:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: fix DMA device NULL pointer dereference The DMA device pointer `dma_dev` was being dereferenced before ensuring that `cdns_ctrl->dmac` is properly initialized. Move the assignment of `dma_dev` after successfully acquiring the DMA channel to ensure the pointer is valid before use.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 23, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0cae7c285f4771a9927ef592899234d307aea5d4 before 2178b0255eae108bb10e5e99658b28641bc06f43; 099a316518508be7c57de4134ef919b2dea948ce builds before 9c58c64ec41290c12490ca7e1df45013fbbb41fd; from e630d32162a8aab92d4aaebae0a8d93039257593 before e282a4fdf3c6ee842a720010a8b5f7d77bedd126; from ad9393467fbd788ac2b8a01e492e45ab1b68a1b1 before b146e0b085d9d6bfe838e0a15481cba7d093c67f; 0ce5416863965ddd86e066484a306867cf1e01a8 builds before 0c635241a62f2f5da1b48bfffae226d1f86a76ef; from d76d22b5096c5b05208fd982b153b3f182350b19 before 0c2a43cb43786011b48eeab6093db14888258c6b; from d76d22b5096c5b05208fd982b153b3f182350b19 before 5c56bf214af85ca042bf97f8584aab2151035840; a33c7492dcdf804b705b6c21018a481414d48038; and 6 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/2178b0255eae108bb10e5e99658b28641bc06f43
https://git.kernel.org/stable/c/9c58c64ec41290c12490ca7e1df45013fbbb41fd
https://git.kernel.org/stable/c/e282a4fdf3c6ee842a720010a8b5f7d77bedd126
https://git.kernel.org/stable/c/b146e0b085d9d6bfe838e0a15481cba7d093c67f
https://git.kernel.org/stable/c/0c635241a62f2f5da1b48bfffae226d1f86a76ef
https://git.kernel.org/stable/c/0c2a43cb43786011b48eeab6093db14888258c6b
https://git.kernel.org/stable/c/5c56bf214af85ca042bf97f8584aab2151035840

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.