LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39937: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer

In the Linux kernel, the following vulnerability has been resolved: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property") rfkill_find_type() gets called with the possibly uninitialized "const char *type_name;" local variable. On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752" acpi_device, the rfkill->type is set based on the ACPI acpi_device_id: rfkill->type = (unsigned)id->driver_data; and there is no "type" property so device_property_read_string() will fail and leave type_name uninitialized, leading to a potential crash. rfkill_find_type() does accept a NULL pointer, fix the potential crash by initializing type_name to NULL. Note likely sofar this has not been caught because: 1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device 2. The stack happened to contain NULL where type_name is stored

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel crash bug in the rfkill-gpio driver. It appears limited to uncommon x86 systems with BCM4752 or LNV4752 ACPI devices. Business impact is likely availability-focused: affected machines may crash when the vulnerable driver path is exercised.

Executive priority

Treat this as routine kernel maintenance unless your fleet includes the specific affected x86 hardware. It does not currently justify emergency response without matching exposure or crash evidence.

Technical view

Since Linux commit 7d5e9737efda, rfkill-gpio can pass an uninitialized type_name pointer into rfkill_find_type() when no device "type" property exists. The fix initializes type_name to NULL, which rfkill_find_type() already accepts.

Likely exposure

Exposure appears narrow: Linux systems using the rfkill-gpio driver on x86 hardware with BCM4752 or LNV4752 ACPI devices and no "type" property. The source notes few systems are expected to match this condition.

Exploitation context

The bundle provides no evidence of active exploitation, and KEV is false. The described impact is a potential crash from dereferencing an uninitialized pointer, not a documented privilege escalation or remote code execution path.

Researcher notes

The key condition is device_property_read_string() failing and leaving type_name uninitialized before rfkill_find_type(). The source explicitly says the issue likely avoided detection because matching hardware is uncommon and stack contents often happened to be NULL.

Mitigation direction

  • Apply Linux stable or distribution kernel updates containing the referenced rfkill-gpio fixes.
  • Prioritize systems with BCM4752 or LNV4752 ACPI devices using rfkill-gpio.
  • Check vendor kernel advisories if your distribution backports fixes without changing version numbers.
  • Monitor kernel crash logs for rfkill-gpio-related failures.

Validation and detection

  • Inventory Linux kernel versions and confirm whether vendor builds include the stable fix commits.
  • Check hardware inventory or ACPI tables for BCM4752 or LNV4752 devices.
  • Confirm rfkill-gpio is present, loaded, or built into affected kernels.
  • Review boot and kernel logs for rfkill-gpio crashes or NULL/uninitialized pointer symptoms.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39937 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7d5e9737efda16535e5b54bd627ef4881d11d31f, 7d5e9737efda16535e5b54bd627ef4881d11d31f, 7d5e9737efda16535e5b54bd627ef4881d11d31f, 7d5e9737efda16535e5b54bd627ef4881d11d31f, 7d5e9737efda16535e5b54bd627ef4881d11d31f, 7d5e9737efda16535e5b54bd627ef4881d11d31f, 7d5e9737efda16535e5b54bd627ef4881d11d31f, 7d5e9737efda16535e5b54bd627ef4881d11d31funaffected
LinuxLinux4.6, 0, 5.4.300, 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.