CVE-2025-22009

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
08/04/2025
Last modified:
01/10/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> regulator: dummy: force synchronous probing<br /> <br /> Sometimes I get a NULL pointer dereference at boot time in kobject_get()<br /> with the following call stack:<br /> <br /> anatop_regulator_probe()<br /> devm_regulator_register()<br /> regulator_register()<br /> regulator_resolve_supply()<br /> kobject_get()<br /> <br /> By placing some extra BUG_ON() statements I could verify that this is<br /> raised because probing of the &amp;#39;dummy&amp;#39; regulator driver is not completed<br /> (&amp;#39;dummy_regulator_rdev&amp;#39; is still NULL).<br /> <br /> In the JTAG debugger I can see that dummy_regulator_probe() and<br /> anatop_regulator_probe() can be run by different kernel threads<br /> (kworker/u4:*). I haven&amp;#39;t further investigated whether this can be<br /> changed or if there are other possibilities to force synchronization<br /> between these two probe routines. On the other hand I don&amp;#39;t expect much<br /> boot time penalty by probing the &amp;#39;dummy&amp;#39; regulator synchronously.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.4 (including) 6.6.85 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.12.21 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.13.9 (excluding)
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*