CVE-2025-38541: wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: Fix null-ptr-deref in mt7925thermalinit()
devmkasprintf() returns NULL on error. Currently, mt7925thermalinit() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devmkasprintf() to prevent this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a NULL check after devm_kasprintf() in mt7925_thermal_init() to handle allocation failure and prevent a NULL-pointer dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38541?
CVE-2025-38541 has a medium severity rating due to the potential for a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2025-38541?
To fix CVE-2025-38541, update to the latest version of the Linux kernel that includes the patch addressing the null pointer dereference in mt7925_thermal_init().
Which Linux kernel versions are affected by CVE-2025-38541?
CVE-2025-38541 affects versions of the Linux kernel that include the mt76 driver for the mt7925 hardware without the applied patch.
What components are primarily impacted by CVE-2025-38541?
The primary component impacted by CVE-2025-38541 is the mt7925 driver within the Linux kernel responsible for wireless networking.
Is CVE-2025-38541 exploitative in nature?
CVE-2025-38541 could potentially be exploited to cause system instability due to the NULL pointer dereference, but it requires specific conditions to trigger.