In the Linux kernel, the following vulnerability has been resolved:
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property") rfkillfindtype() gets called with the possibly uninitialized "const char *type_name;" local variable.
On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752" acpidevice, the rfkill->type is set based on the ACPI acpidevice_id:
rfkill->type = (unsigned)id->driver_data;
and there is no "type" property so devicepropertyreadstring() will fail and leave typename uninitialized, leading to a potential crash.
rfkillfindtype() does accept a NULL pointer, fix the potential crash by initializing type_name to NULL.
Note likely sofar this has not been caught because:
[
{
"deprecated": false,
"id": "CVE-2025-39937-12fc5927",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8793e7a8e1b60131a825457174ed6398111daeb7",
"signature_version": "v1",
"target": {
"function": "rfkill_gpio_probe",
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "140343247736541274689265098073598273511",
"length": 1650.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-1693553c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8793e7a8e1b60131a825457174ed6398111daeb7",
"signature_version": "v1",
"target": {
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"290031934758491973608192251865384874607",
"337795633212023660316459316348441770160",
"253618838232416668555879300404512770495",
"328711750439078655470682982102157308402",
"165099635416793243461580675756705706857",
"179857563953144240665027334643931077473",
"52368971447119137505699716873334466487"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-294c57b7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ada2282259243387e6b6e89239aeb4897e62f051",
"signature_version": "v1",
"target": {
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"290031934758491973608192251865384874607",
"337795633212023660316459316348441770160",
"253618838232416668555879300404512770495",
"328711750439078655470682982102157308402",
"165099635416793243461580675756705706857",
"179857563953144240665027334643931077473",
"52368971447119137505699716873334466487"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-337b1bfa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@689aee35ce671aab752f159e5c8e66d7685e6887",
"signature_version": "v1",
"target": {
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"290031934758491973608192251865384874607",
"337795633212023660316459316348441770160",
"253618838232416668555879300404512770495",
"328711750439078655470682982102157308402",
"165099635416793243461580675756705706857",
"179857563953144240665027334643931077473",
"52368971447119137505699716873334466487"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-4446a9aa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ada2282259243387e6b6e89239aeb4897e62f051",
"signature_version": "v1",
"target": {
"function": "rfkill_gpio_probe",
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "140343247736541274689265098073598273511",
"length": 1650.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-89138d47",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ade5f9d70b23a119ec20b1c6504864b2543a79",
"signature_version": "v1",
"target": {
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"290031934758491973608192251865384874607",
"337795633212023660316459316348441770160",
"253618838232416668555879300404512770495",
"328711750439078655470682982102157308402",
"165099635416793243461580675756705706857",
"179857563953144240665027334643931077473",
"52368971447119137505699716873334466487"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-930c9819",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d",
"signature_version": "v1",
"target": {
"function": "rfkill_gpio_probe",
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "249861572207008164607156010357765720019",
"length": 1806.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-9ae2bc4b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d",
"signature_version": "v1",
"target": {
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"290031934758491973608192251865384874607",
"337795633212023660316459316348441770160",
"253618838232416668555879300404512770495",
"328711750439078655470682982102157308402",
"165099635416793243461580675756705706857",
"264035426218813093805702972223426965482",
"23960062173197688027663877680926975966"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-ae42713b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6f56a44e4c1014b08859dcf04ed246500e310e5",
"signature_version": "v1",
"target": {
"function": "rfkill_gpio_probe",
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "249861572207008164607156010357765720019",
"length": 1806.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-cb56ea11",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ade5f9d70b23a119ec20b1c6504864b2543a79",
"signature_version": "v1",
"target": {
"function": "rfkill_gpio_probe",
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "140343247736541274689265098073598273511",
"length": 1650.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-ddacfc7c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@689aee35ce671aab752f159e5c8e66d7685e6887",
"signature_version": "v1",
"target": {
"function": "rfkill_gpio_probe",
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "140343247736541274689265098073598273511",
"length": 1650.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39937-f752b3c9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6f56a44e4c1014b08859dcf04ed246500e310e5",
"signature_version": "v1",
"target": {
"file": "net/rfkill/rfkill-gpio.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"290031934758491973608192251865384874607",
"337795633212023660316459316348441770160",
"253618838232416668555879300404512770495",
"328711750439078655470682982102157308402",
"165099635416793243461580675756705706857",
"264035426218813093805702972223426965482",
"23960062173197688027663877680926975966"
],
"threshold": 0.9
}
}
]