CVE-2025-21982: pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xxgpiofw
devmkasprintf() calls can return null pointers on failure. But the return values were not checked in npcm8xxgpiofw(). Add NULL check in npcm8xxgpiofw(), to handle kernel NULL pointer dereference error.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add NULL checks for the return values of devm_kasprintf() in npcm8xx_gpio_fw() before dereferencing them.
pinctrl: nuvoton: npcm8xx NULL checks for devm_kasprintf() return values in npcm8xx_gpio_fw() = checked before dereference
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21982?
CVE-2025-21982 has a medium severity rating due to potential null pointer dereference risks.
What are the potential impacts of CVE-2025-21982?
The vulnerability could lead to a denial of service if the NULL pointer dereference occurs.
How do I fix CVE-2025-21982?
To fix CVE-2025-21982, update to the patched version of the Linux kernel that includes the NULL check.
Which versions of the Linux kernel are affected by CVE-2025-21982?
CVE-2025-21982 affects various versions of the Linux kernel before the patch was applied.
Are there any workarounds for CVE-2025-21982?
There are no recommended workarounds for CVE-2025-21982; applying the kernel update is necessary.