CVE-2025-23136
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, the int340x thermal driver lacked a NULL check for the ACPI device pointer (adev), which could lead to a NULL pointer dereference in int3402_thermal_probe(). A check has been added, returning -ENODEV if adev is NULL.
Risk Assessment
Missing NULL check for adev may cause a kernel panic during thermal driver initialization on platforms where the device has no ACPI companion fwnode.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit adding NULL check for adev in int340x_thermal).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for adev == NULL"). Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe(). Note, under the same directory, int3400_thermal_probe() has such a check. [ rjw: Subject edit, added Fixes: ]