CVE-2025-39937 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property") rfkill_find_type() gets called with the possibly uninitialized "const char *type_name;" local variable. On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752" acpi_device, the rfkill->type is set based on the ACPI acpi_device_id: rfkill->type = (unsigned)id->driver_data; and there is no "type" property so device_property_read_string() will fail and leave type_name uninitialized, leading to a potential crash. rfkill_find_type() does accept a NULL pointer, fix the potential crash by initializing type_name to NULL. Note likely sofar this has not been caught because: 1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device 2. The stack happened to contain NULL where type_name is stored
A vulnerability in the Linux kernel's RFKill GPIO handling can lead to a crash due to dereferencing an uninitialized pointer. This issue occurs on x86 systems when the RFKill GPIO driver binds to certain ACPI devices, specifically 'BCM4752' or 'LNV4752'. In these cases, the RFKill type is set based on the ACPI device ID, but without a corresponding 'type' property, the device property read operation fails, leaving the type name uninitialized. This uninitialized pointer can cause a crash when the RFKill type is processed. The vulnerability has been addressed by initializing the type name to NULL before use.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version where this issue has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/184f608a68f96794e8fe58cd5535014d53622cde | kernel.org | Patch |
| https://git.kernel.org/stable/c/21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d | kernel.org | Patch |
| https://git.kernel.org/stable/c/21ba85d9d508422ca9e6698463ff9357c928c22d | kernel.org | Patch |
| https://git.kernel.org/stable/c/47ade5f9d70b23a119ec20b1c6504864b2543a79 | kernel.org | Patch |
| https://git.kernel.org/stable/c/689aee35ce671aab752f159e5c8e66d7685e6887 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8793e7a8e1b60131a825457174ed6398111daeb7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ada2282259243387e6b6e89239aeb4897e62f051 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b6f56a44e4c1014b08859dcf04ed246500e310e5 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.6, < 5.4.300 >= 5.5, < 5.10.245 >= 5.11, < 5.15.194 >= 5.16, < 6.1.154 >= 6.2, < 6.6.108 >= 6.7, < 6.12.49 >= 6.13, < 6.16.9 6.17 rc1 6.17 rc2 6.17 rc3 6.17 rc4 6.17 rc5 6.17 rc6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Mar 25, 2026 | Modified Analysis | [email protected] |
| Jan 27, 2026 | Initial Analysis | [email protected] |
| Oct 4, 2025 | New CVE Received | kernel.org |