cbcvebase.
CVE-2025-39937
published 2025-10-04

CVE-2025-39937: In the Linux kernel, the following vulnerability has been resolved: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Since commit…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.14%
3.5th percentile
In the Linux kernel, the following vulnerability has been resolved: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property") rfkill_find_type() gets called with the possibly uninitialized "const char *type_name;" local variable. On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752" acpi_device, the rfkill->type is set based on the ACPI acpi_device_id: rfkill->type = (unsigned)id->driver_data; and there is no "type" property so device_property_read_string() will fail and leave type_name uninitialized, leading to a potential crash. rfkill_find_type() does accept a NULL pointer, fix the potential crash by initializing type_name to NULL. Note likely sofar this has not been caught because: 1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device 2. The stack happened to contain NULL where type_name is stored

Affected

31 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.158-1 (bookworm)linux 6.1.158-1 (bookworm)
debianlinux-6.1< linux 6.1.158-1 (bookworm)linux 6.1.158-1 (bookworm)
linuxlinux
linuxlinux>= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 184f608a68f96794e8fe58cd5535014d53622cde184f608a68f96794e8fe58cd5535014d53622cde
linuxlinux>= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 8793e7a8e1b60131a825457174ed6398111daeb78793e7a8e1b60131a825457174ed6398111daeb7
linuxlinux>= 7d5e9737efda16535e5b54bd627ef4881d11d31f < ada2282259243387e6b6e89239aeb4897e62f051ada2282259243387e6b6e89239aeb4897e62f051
linuxlinux>= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 47ade5f9d70b23a119ec20b1c6504864b2543a7947ade5f9d70b23a119ec20b1c6504864b2543a79
linuxlinux>= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 689aee35ce671aab752f159e5c8e66d7685e6887689aee35ce671aab752f159e5c8e66d7685e6887
linuxlinux>= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 21ba85d9d508422ca9e6698463ff9357c928c22d21ba85d9d508422ca9e6698463ff9357c928c22d
linuxlinux>= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d
linuxlinux>= 7d5e9737efda16535e5b54bd627ef4881d11d31f < b6f56a44e4c1014b08859dcf04ed246500e310e5b6f56a44e4c1014b08859dcf04ed246500e310e5
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.247-15.10.247-1
linuxlinux_kernel>= 0 < 6.1.158-16.1.158-1
linuxlinux_kernel>= 0 < 6.12.57-16.12.57-1
linuxlinux_kernel>= 0 < 6.16.9-16.16.9-1
linuxlinux_kernel>= 0 < 5.15.0-170.1805.15.0-170.180
linuxlinux_kernel>= 0 < 6.8.0-106.1066.8.0-106.106
linuxlinux_kernel>= 4.6 < 5.4.3005.4.300
linuxlinux_kernel>= 5.11 < 5.15.1945.15.194
linuxlinux_kernel>= 5.16 < 6.1.1546.1.154
linuxlinux_kernel>= 5.5 < 5.10.2455.10.245
linuxlinux_kernel>= 6.13 < 6.16.96.16.9
linuxlinux_kernel>= 6.2 < 6.6.1086.6.108
linuxlinux_kernel>= 6.7 < 6.12.496.12.49

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.