Kernel Vulnerability in Linux Package: NULL Pointer Dereference in Nuvoton NPCM8XX GPIO Firmware
Summary
DEBIAN-CVE-2025-21982: In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw devm_kasprintf() calls can return null pointers on failure. Affects linux versions < 6.12.20-1. Fixed in 6.12.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is modular, allowing for various functionalities to be added or removed as needed. The vulnerability in question affects the 'linux' package in Debian versions 13 and 14, specifically in the pinctrl subsystem for Nuvoton NPCM8XX GPIO firmware, which is responsible for managing General Purpose Input/Output (GPIO) pins.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the pinctrl subsystem related to the Nuvoton NPCM8XX GPIO firmware. The issue arises from the lack of a NULL pointer check in the npcm8xx_gpio_fw() function, which calls devm_kasprintf(). If this function fails, it can return a NULL pointer, leading to a potential kernel NULL pointer dereference error. This vulnerability could result in system instability or crashes, posing a significant risk to system integrity and availability.
How To Fix
Minimum fixed version
6.12.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability identified in the Linux kernel related to the Nuvoton NPCM8XX GPIO firmware poses a significant risk due to the potential for system crashes caused by NULL pointer dereference. It is crucial for users of Debian versions 13 and 14 to update their systems to the patched version to ensure security and stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the npcm8xx_gpio_fw() function of the Linux kernel, which can lead to system crashes.
Debian versions 13 and 14 are affected by this vulnerability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
While there are no specific workarounds, it is recommended to monitor the situation and apply the patch as soon as possible.
Failure to address this vulnerability could lead to system instability, crashes, and potential exploitation by malicious actors.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
