CVE-2025-23136: thermal: int340x: Add NULL check for adev
In the Linux kernel, the following vulnerability has been resolved:
thermal: int340x: Add NULL check for adev
Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for adev == NULL").
Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402thermalprobe().
Note, under the same directory, int3400thermalprobe() has such a check.
[ rjw: Subject edit, added Fixes: ]
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23136?
The severity of CVE-2025-23136 is rated as medium due to the potential for null pointer dereference affecting certain Linux kernel configurations.
How do I fix CVE-2025-23136?
To fix CVE-2025-23136, ensure your Linux kernel is updated to the latest version where this vulnerability is patched.
What type of vulnerability is CVE-2025-23136?
CVE-2025-23136 is classified as a null pointer dereference vulnerability in the thermal subsystem of the Linux kernel.
Which systems are affected by CVE-2025-23136?
CVE-2025-23136 affects Linux systems utilizing the int340x thermal driver when devices lack an ACPI companion fwnode.
Is CVE-2025-23136 actively being exploited?
As of now, there are no known exploits actively targeting CVE-2025-23136 in the wild.