CVE-2025-37748

iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group Currently, mtk_iommu calls during probe iommu_device_register before the hw_list from driver data is initialized. Since iommu probing issue fix, it leads to NULL pointer dereference in mtk_iommu_device_group when hw_list is accessed with list_first_entry (not null safe). So, change the call order to ensure iommu_device_register is called after the driver data are initialized.

N/A

CVSS

Severity:

EPSS 0.03%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/2f75cb27bef43c8692b0f5e471e5632f6a9beb99
https://git.kernel.org/stable/c/6abd09bed43b8d83d461e0fb5b9a200a06aa8a27
https://git.kernel.org/stable/c/a0842539e8ef9386c070156103aff888e558a60c
https://git.kernel.org/stable/c/ce7d3b2f6f393fa35f0ea12861b83a1ca28b295c
https://git.kernel.org/stable/c/69f9d2d37d1207c5a73dac52a4ce1361ead707f5
https://git.kernel.org/stable/c/38e8844005e6068f336a3ad45451a562a0040ca1

Frequently Asked Questions

What is the severity of CVE-2025-37748?: CVE-2025-37748 has not yet been assigned a CVSS score.
How to fix CVE-2025-37748?: To fix CVE-2025-37748, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-37748 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-37748 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-37748?: CVE-2025-37748 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.