CVE-2025-23136

thermal: int340x: Add NULL check for adev

Description

In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for adev == NULL"). Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe(). Note, under the same directory, int3400_thermal_probe() has such a check. [ rjw: Subject edit, added Fixes: ]

Category

5.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.02%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/d0d21c8e44216fa9afdb3809edf213f3c0a8c060 patch
https://git.kernel.org/stable/c/bc7b5f782d28942dbdfda70df30ce132694a06de patch
https://git.kernel.org/stable/c/3155d5261b518776d1b807d9d922669991bbee56 patch
https://git.kernel.org/stable/c/6a810c462f099353e908c70619638884cb82229c patch
https://git.kernel.org/stable/c/ac2eb7378319e3836cdf3a2c15a0bdf04c50e81d patch
https://git.kernel.org/stable/c/953d28a4f459fcbde2d08f51aeca19d6b0f179f3 patch
https://git.kernel.org/stable/c/0c49f12c77b77a706fd41370c11910635e491845 patch
https://git.kernel.org/stable/c/8e8f1ddf4186731649df8bc9646017369eb19186 patch
https://git.kernel.org/stable/c/2542a3f70e563a9e70e7ded314286535a3321bdb patch

Frequently Asked Questions

What is the severity of CVE-2025-23136?
CVE-2025-23136 has been scored as a medium severity vulnerability.
How to fix CVE-2025-23136?
To fix CVE-2025-23136, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-23136 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-23136 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-23136?
CVE-2025-23136 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.