CVE-2025-37972: Input: mtk-pmic-keys - fix possible null pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
Input: mtk-pmic-keys - fix possible null pointer dereference
In mtkpmickeysprobe, the regs parameter is only set if the button is parsed in the device tree. However, on hardware where the button is left floating, that node will most likely be removed not to enable that input. In that case the code will try to dereference a null pointer.
Let's use the regs struct instead as it is defined for all supported platforms. Note that it is ok setting the key reg even if that latter is disabled as the interrupt won't be enabled anyway.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37972?
The severity of CVE-2025-37972 has been classified as medium due to its potential for a null pointer dereference in the Linux kernel.
How do I fix CVE-2025-37972?
To fix CVE-2025-37972, ensure you update the Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-37972?
CVE-2025-37972 affects systems running vulnerable versions of the Linux kernel that utilize the mtk-pmic-keys device driver.
What are the potential impacts of CVE-2025-37972?
The potential impacts of CVE-2025-37972 include system crashes and unexpected behavior due to the null pointer dereference.
Is CVE-2025-37972 related to specific hardware?
Yes, CVE-2025-37972 is related to specific hardware configurations where button input is not adequately handled in the device tree.