Null Pointer Dereference in Linux Kernel's mtk-pmic-keys Package
Summary
CVE-2025-37972: In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys - fix possible null pointer dereference In mtk_pmic_keys_probe, the regs parameter is only set if the button is parsed in the devic... Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The mtk-pmic-keys module is responsible for handling power management integrated circuit (PMIC) key inputs. This module is crucial for devices that rely on button inputs for user interaction. However, it has been identified that under certain conditions, the module can lead to a null pointer dereference, potentially causing system instability.
Vulnerability Detail
The vulnerability arises in the mtk_pmic_keys_probe function, where the 'regs' parameter is only initialized if the button is defined in the device tree. On hardware configurations where the button input is not present, the absence of this node leads to a null pointer dereference when the code attempts to access it. This can result in a system crash or unexpected behavior, compromising the reliability of the device.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can ensure that the device tree includes the necessary button definitions, or modify the code to check for null pointers before dereferencing them. However, the best solution is to apply the patch provided in the updated kernel version.
Conclusion
The identified null pointer dereference vulnerability in the mtk-pmic-keys module of the Linux kernel poses a significant risk to system stability. Users are strongly advised to update their kernel to the latest version to mitigate this issue. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of vulnerabilities.
See every vulnerability recorded for linux →
FAQ
A null pointer dereference occurs when a program attempts to access memory that has not been allocated, leading to crashes or undefined behavior.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Failing to address this vulnerability can lead to system crashes, data loss, and potential exploitation by malicious actors.
Yes, users should upgrade to the latest version of the Linux kernel provided by their distribution to ensure that this vulnerability is patched.
Yes, Vulert allows you to monitor and receive alerts for open-source vulnerabilities in your software using just a manifest file, making it easy to stay informed.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
