CVE-2025-22084

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22084
In the Linux kernel, the following vulnerability has been resolved: w1: fix NULL pointer dereference in probe The w1_uart_probe() function calls w1_uart_serdev_open() (which includes devm_serdev_device_open()) before setting the client ops via serdev_device_set_client_ops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receive_buf handler, as it assumes serdev->ops is valid when SERPORT_ACTIVE is set. This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: cros_ec_uart: properly fix race condition") where devm_serdev_device_open() was called before fully initializing the device. Fix the race by ensuring client ops are set before enabling the port via w1_uart_serdev_open().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0dd6770a72f138dabea9eae87f3da6ffa68f0d06 Patch
https://git.kernel.org/stable/c/4f750b84628080ff0d67bf1af67a4967b740acf2 Patch
https://git.kernel.org/stable/c/64ab50577c59bb7049bec6b5c42d1c38e4029f29 Patch
https://git.kernel.org/stable/c/cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

31 Oct 2025, 20:57

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: w1: corrección de la desreferencia de puntero nulo en la sonda. La función w1_uart_probe() llama a w1_uart_serdev_open() (que incluye devm_serdev_device_open()) antes de configurar las operaciones del cliente mediante serdev_device_set_client_ops(). Este orden puede desencadenar una desreferencia de puntero nulo en el controlador receive_buf del controlador serdev, ya que asume que serdev->ops es válido cuando SERPORT_ACTIVE está configurado. Esto es similar al problema corregido en el commit 5e700b384ec1 ("platform/chrome: cros_ec_uart: corregir correctamente la condición de ejecución") donde se llamó a devm_serdev_device_open() antes de inicializar completamente el dispositivo. Corrija la ejecución asegurándose de que las operaciones del cliente estén configuradas antes de habilitar el puerto mediante w1_uart_serdev_open().
CWE CWE-476
References () https://git.kernel.org/stable/c/0dd6770a72f138dabea9eae87f3da6ffa68f0d06 - () https://git.kernel.org/stable/c/0dd6770a72f138dabea9eae87f3da6ffa68f0d06 - Patch
References () https://git.kernel.org/stable/c/4f750b84628080ff0d67bf1af67a4967b740acf2 - () https://git.kernel.org/stable/c/4f750b84628080ff0d67bf1af67a4967b740acf2 - Patch
References () https://git.kernel.org/stable/c/64ab50577c59bb7049bec6b5c42d1c38e4029f29 - () https://git.kernel.org/stable/c/64ab50577c59bb7049bec6b5c42d1c38e4029f29 - Patch
References () https://git.kernel.org/stable/c/cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298 - () https://git.kernel.org/stable/c/cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298 - Patch

16 Apr 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 15:16

Updated : 2025-10-31 20:57

NVD link : CVE-2025-22084

Mitre link : CVE-2025-22084

CVE.ORG link : CVE-2025-22084

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference