CVE-2025-22009 Details
Description
In the Linux kernel, the following vulnerability has been resolved: regulator: dummy: force synchronous probing Sometimes I get a NULL pointer dereference at boot time in kobject_get() with the following call stack: anatop_regulator_probe() devm_regulator_register() regulator_register() regulator_resolve_supply() kobject_get() By placing some extra BUG_ON() statements I could verify that this is raised because probing of the 'dummy' regulator driver is not completed ('dummy_regulator_rdev' is still NULL). In the JTAG debugger I can see that dummy_regulator_probe() and anatop_regulator_probe() can be run by different kernel threads (kworker/u4:*). I haven't further investigated whether this can be changed or if there are other possibilities to force synchronization between these two probe routines. On the other hand I don't expect much boot time penalty by probing the 'dummy' regulator synchronously.
A vulnerability in the Linux kernel's dummy regulator driver can lead to a NULL pointer dereference during boot. This issue arises because the probing of the dummy regulator is not completed, causing a subsequent call to 'kobject_get()' to fail. The problem can occur when the 'dummy_regulator_probe()' and 'anatop_regulator_probe()' functions are executed by different kernel threads, potentially leading to a race condition. Although this vulnerability can be reproduced by forcing asynchronous probing, it is expected that synchronizing the probing would not significantly impact boot time.
The vulnerability can be addressed by modifying the 'dummy' regulator driver to ensure that probing is done synchronously, completing the initialization before any dependent functions are called.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/5ade367b56c3947c990598df92395ce737bee872 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8619909b38eeebd3e60910158d7d68441fc954e9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d3b83a1442a09b145006eb4294b1a963c5345c9c | kernel.org | Patch |
| https://git.kernel.org/stable/c/e26f24ca4fb940b15e092796c5993142a2558bd9 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.4, < 6.6.85 >= 6.7, < 6.12.21 >= 6.13, < 6.13.9 6.14 rc1 6.14 rc2 6.14 rc3 6.14 rc4 6.14 rc5 6.14 rc6 6.14 rc7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 1, 2025 | CVE Modified | CISA-ADP |
| Apr 10, 2025 | Initial Analysis | [email protected] |
| Apr 8, 2025 | New CVE Received | kernel.org |