CVE-2025-22084

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-22084
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22084.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-22084
Downstream
Published
2025-04-16T14:12:32.950Z
Modified
2025-11-20T09:00:52.726321Z
Summary
w1: fix NULL pointer dereference in probe
Details

In the Linux kernel, the following vulnerability has been resolved:

w1: fix NULL pointer dereference in probe

The w1uartprobe() function calls w1uartserdevopen() (which includes devmserdevdeviceopen()) before setting the client ops via serdevdevicesetclientops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receivebuf handler, as it assumes serdev->ops is valid when SERPORTACTIVE is set.

This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: crosecuart: properly fix race condition") where devmserdevdevice_open() was called before fully initializing the device.

Fix the race by ensuring client ops are set before enabling the port via w1uartserdev_open().

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a3c08804364e80328a9ffdac59bb26676b938195
Fixed
4f750b84628080ff0d67bf1af67a4967b740acf2
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a3c08804364e80328a9ffdac59bb26676b938195
Fixed
64ab50577c59bb7049bec6b5c42d1c38e4029f29
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a3c08804364e80328a9ffdac59bb26676b938195
Fixed
cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a3c08804364e80328a9ffdac59bb26676b938195
Fixed
0dd6770a72f138dabea9eae87f3da6ffa68f0d06

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.13.1
v6.13.10
v6.13.2
v6.13.3
v6.13.4
v6.13.5
v6.13.6
v6.13.7
v6.13.8
v6.13.9
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.14.1
v6.8
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "digest": {
            "line_hashes": [
                "216288072770245462391629670105058323181",
                "166414421302321349179226268924816463673",
                "170048320450661946461616936219580860039",
                "69864964903348437208135634392574937209",
                "290485878033681069177666819364744938054",
                "108571176235732885328259308066888125249",
                "284069770537268912166290524234855269473",
                "224347950192012288839499392448974812653"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "drivers/w1/masters/w1-uart.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64ab50577c59bb7049bec6b5c42d1c38e4029f29",
        "id": "CVE-2025-22084-00c309e4",
        "signature_type": "Line"
    },
    {
        "digest": {
            "line_hashes": [
                "216288072770245462391629670105058323181",
                "166414421302321349179226268924816463673",
                "170048320450661946461616936219580860039",
                "69864964903348437208135634392574937209",
                "290485878033681069177666819364744938054",
                "108571176235732885328259308066888125249",
                "284069770537268912166290524234855269473",
                "224347950192012288839499392448974812653"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "drivers/w1/masters/w1-uart.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f750b84628080ff0d67bf1af67a4967b740acf2",
        "id": "CVE-2025-22084-40ecb6ad",
        "signature_type": "Line"
    },
    {
        "digest": {
            "line_hashes": [
                "216288072770245462391629670105058323181",
                "166414421302321349179226268924816463673",
                "170048320450661946461616936219580860039",
                "69864964903348437208135634392574937209",
                "290485878033681069177666819364744938054",
                "108571176235732885328259308066888125249",
                "284069770537268912166290524234855269473",
                "224347950192012288839499392448974812653"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "drivers/w1/masters/w1-uart.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298",
        "id": "CVE-2025-22084-5928f6bc",
        "signature_type": "Line"
    },
    {
        "digest": {
            "length": 560.0,
            "function_hash": "315816005084523167318077852148386056297"
        },
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "w1_uart_probe",
            "file": "drivers/w1/masters/w1-uart.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dd6770a72f138dabea9eae87f3da6ffa68f0d06",
        "id": "CVE-2025-22084-7844dca0",
        "signature_type": "Function"
    },
    {
        "digest": {
            "length": 560.0,
            "function_hash": "315816005084523167318077852148386056297"
        },
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "w1_uart_probe",
            "file": "drivers/w1/masters/w1-uart.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f750b84628080ff0d67bf1af67a4967b740acf2",
        "id": "CVE-2025-22084-a92ede23",
        "signature_type": "Function"
    },
    {
        "digest": {
            "length": 560.0,
            "function_hash": "315816005084523167318077852148386056297"
        },
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "w1_uart_probe",
            "file": "drivers/w1/masters/w1-uart.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64ab50577c59bb7049bec6b5c42d1c38e4029f29",
        "id": "CVE-2025-22084-b97c7718",
        "signature_type": "Function"
    },
    {
        "digest": {
            "length": 560.0,
            "function_hash": "315816005084523167318077852148386056297"
        },
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "w1_uart_probe",
            "file": "drivers/w1/masters/w1-uart.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298",
        "id": "CVE-2025-22084-d8585ed7",
        "signature_type": "Function"
    },
    {
        "digest": {
            "line_hashes": [
                "216288072770245462391629670105058323181",
                "166414421302321349179226268924816463673",
                "170048320450661946461616936219580860039",
                "69864964903348437208135634392574937209",
                "290485878033681069177666819364744938054",
                "108571176235732885328259308066888125249",
                "284069770537268912166290524234855269473",
                "224347950192012288839499392448974812653"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "drivers/w1/masters/w1-uart.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dd6770a72f138dabea9eae87f3da6ffa68f0d06",
        "id": "CVE-2025-22084-df4044d3",
        "signature_type": "Line"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.9.0
Fixed
6.12.23
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.11
Type
ECOSYSTEM
Events
Introduced
6.14.0
Fixed
6.14.2